|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Payload
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Meta JSON brut
{
"bytes_in": 90,
"payload_entropy": 3.363000349268878,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4af072de9a74c3ed767895a558661d0c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"evidence": {
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c44681254b7c989d7e52994d449c1df8a0688b3",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9161
},
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Payload
*%� Cookie: mstshash=test
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
*%� Cookie: mstshash=test
Meta JSON brut
{
"bytes_in": 42,
"payload_entropy": 3.9214974820450146,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86694eeca7d01319c2e510ca0cdb19fa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e2bfee6040aeb4d7b5a0fc879d6459719b1e318",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9161
},
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
PU:t3://us-l-breens:7001
Meta JSON brut
{
"bytes_in": 60,
"payload_entropy": 4.406669454469437,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8960d40e6994de8fd77efce8caef63bda0c4afcd",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9161
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161 · MSSQL
|
mssql
|
Scan de ports
port scan syn · via MSSQL:9161 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Service
MSSQL
Payload
: ! - 1 � MSSQLServer <�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ! - 1 � MSSQLServer <�
Meta JSON brut
{
"bytes_in": 58,
"payload_entropy": 3.4275271990270237,
"port_category": "registered",
"org": "Google LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e04abe5d93f69c9c8342738feee549cb37962e8a",
"event_fingerprint": "2bb02c16e2806c728eddb95af77d40f4da6c6a0b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c254a2e0618be32415a97df79ee8d3b4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"service": "mssql",
"service_name": "mssql",
"risk_score": 42
},
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "338e24b5db8cd76b4848cfdd24361db454998d0e",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"port": 9161,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd",
"attack_vector": "port scan syn \u00b7 via MSSQL:9161 \u00b7 (reconnaissance)",
"target_port_label": "9161 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MSSQL \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"port": 9161,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "port scan syn \u00b7 via MSSQL:9161 \u00b7 (reconnaissance)",
"evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd",
"target_port_label": "9161 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
GIOP WebSphere IIOP
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
GIOP NameService
Meta JSON brut
{
"bytes_in": 35,
"payload_entropy": 3.4133442623458246,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"GIOP WebSphere IIOP",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ee188bd883954b153869cc7ff2dcd2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"evidence": {
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15fefbc4b1b56a1fccb93d69b417aa39dbc98a86",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9161
},
"evidence_snippet": "GIOPNameService",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "GIOPNameService",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SMB negotiate
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 24,
"payload_entropy": 1.0238995733215064,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"SMB negotiate",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b54520be3d454f6926b094aac799ac34",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "643487121f94a038deaa40b426d482f500ce98c3",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
WHOAREYOU?
Meta JSON brut
{
"bytes_in": 10,
"payload_entropy": 3.121928094887362,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "762698422aeb434c563df0d64d39eea3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "WHOAREYOU?",
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"evidence": {
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e8a3c361bd905e0b586b91c0aeb4433815cea8f",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9161
},
"evidence_snippet": "WHOAREYOU?",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "WHOAREYOU?",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 2,
"payload_entropy": 1,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7eb70257593da06f682a3ddda54a9d26",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "\r\n",
"request_sample": "\r\n",
"evidence": {
"request_sample": "\r\n",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac33ed9fde605ef0df6c77d45f036d5ba647dbb2",
"protocol_details": {
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Payload
zal238hcxjky129xz@!*#
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
zal238hcxjky129xz@!*#
Meta JSON brut
{
"bytes_in": 23,
"payload_entropy": 4.262692390839622,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1a1715b3efb95433e20233a8eef266d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"evidence": {
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "911b9768b3527a8c83e998fa34d7723c8ac3b65c",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9161
},
"evidence_snippet": "zal238hcxjky129xz@!*#",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "zal238hcxjky129xz@!*#",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161 · VNC
|
vnc
|
Scan de ports
port scan syn · via VNC:9161 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
vnc_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Service
VNC
Payload
RFB 003.003
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
RFB 003.003
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 2.751629167387823,
"port_category": "registered",
"org": "Google LLC",
"service": "vnc",
"app_proto": "vnc",
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 28,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "82d4fc2edaeb2815c5e4fac79dc3782b887b2c1c",
"event_fingerprint": "f9bdc483f87d52076e583fc9070c3bb12818a52e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "vnc",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba4bf75c6ca831dd6ab37a2c5e7413b5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"service": "vnc",
"service_name": "vnc",
"risk_score": 42
},
"payload_preview": "RFB 003.003\n",
"request_sample": "RFB 003.003\n",
"payload_snippet": "RFB 003.003",
"evidence": {
"request_sample": "RFB 003.003\n",
"payload_snippet": "RFB 003.003",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3651bf26aa536b2e4c3f8e8482d0b4898799c600",
"protocol_details": {
"payload_preview": "RFB 003.003",
"port": 9161,
"service": "vnc",
"service_label_fr": "VNC"
},
"evidence_snippet": "RFB 003.003",
"attack_vector": "port scan syn \u00b7 via VNC:9161 \u00b7 (reconnaissance)",
"target_port_label": "9161 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "RFB 003.003",
"port": 9161,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port scan syn \u00b7 via VNC:9161 \u00b7 (reconnaissance)",
"evidence_snippet": "RFB 003.003",
"target_port_label": "9161 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"vnc_banner"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Memcached stats
Memcached stats
ET Memcached UDP
User-Agent
—
Règles WAF
—
Payload (extrait)
stats
quit
Meta JSON brut
{
"bytes_in": 15,
"payload_entropy": 2.822579761842491,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_pattern_names": [
"Memcached stats",
"Memcached stats",
"ET Memcached UDP"
],
"pattern_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b6167d063664acd0adfde8c56cf6184c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "stats\r\n\r\nquit\r\n",
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"evidence": {
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab4a19bcbe69ffa8ade099174fa74f2e1d0c9162",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9161
},
"evidence_snippet": "stats\r\n\r\nquit",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "stats\r\n\r\nquit",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
envi
quit
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 3.084962500721156,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b66d77430fe371a75bb9845dd40b7d3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "envi\r\nquit\r\n",
"request_sample": "envi\r\nquit\r\n",
"payload_snippet": "envi\r\nquit",
"evidence": {
"request_sample": "envi\r\nquit\r\n",
"payload_snippet": "envi\r\nquit",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bf7dbeef2d4e3ad6932ef277445f2b3c9672ca9",
"protocol_details": {
"payload_preview": "envi\r\nquit",
"port": 9161
},
"evidence_snippet": "envi\r\nquit",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "envi\r\nquit",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "envi\r\nquit",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
OPC UA HEL
User-Agent
—
Règles WAF
—
Payload (extrait)
help\r\n
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.75,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0626"
],
"matched_pattern_names": [
"OPC UA HEL"
],
"pattern_ids": [
"pat-0626"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ca107f6ced851d3e7dedfb06144f2f1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"payload_preview": "help\\r\\n",
"request_sample": "help\\r\\n",
"payload_snippet": "help\\r\\n",
"evidence": {
"request_sample": "help\\r\\n",
"payload_snippet": "help\\r\\n",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eeaf022cb1164e0521d5eff500953e6527cb7144",
"protocol_details": {
"payload_preview": "help\\r\\n",
"port": 9161
},
"evidence_snippet": "help\\r\\n",
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "help\\r\\n",
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": "help\\r\\n",
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9161
|
—
|
Scan de ports
port scan syn · port 9161 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9161
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9161,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6b621a49da9c46bf4debbdcccb779e96d590270a",
"event_fingerprint": "8b50d5db7d03f3e48f1f1bae7b136eeb43d2f206",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9161,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd356c6ba83dbdaceb8f6f219fb8fca5d29b47bd",
"protocol_details": {
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"target_port_label": "9161",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9161,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9161
},
"attack_vector": "port scan syn \u00b7 port 9161 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9161",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8488",
"port:8831",
"port:8907",
"port:9098",
"port:9136"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 2,
"payload_entropy": 1,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7eb70257593da06f682a3ddda54a9d26",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 33
},
"payload_preview": "\r\n",
"request_sample": "\r\n",
"evidence": {
"request_sample": "\r\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a20281ccfa7877c52ed32d190a952db783012a3",
"protocol_details": {
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde OPC-UA
opcua probe · port 9136 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « opcua_probe » (signaux protocolaires) · confiance 47%
Confiance classification
65%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0626
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
OPC UA HEL
User-Agent
—
Règles WAF
—
Payload (extrait)
help\r\n
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.75,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 56,
"precision_signals": [
"pat-0626"
],
"kb_rule_ids": [
"pat-0626"
],
"matched_patterns": [
"pat-0626"
],
"matched_pattern_names": [
"OPC UA HEL"
],
"pattern_ids": [
"pat-0626"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ca107f6ced851d3e7dedfb06144f2f1",
"path_pattern_hash": "9665a326f7d8f70f1661dab78807b951"
},
"target_context": {
"dst_port": 9136,
"risk_score": 35
},
"payload_preview": "help\\r\\n",
"request_sample": "help\\r\\n",
"payload_snippet": "help\\r\\n",
"evidence": {
"request_sample": "help\\r\\n",
"payload_snippet": "help\\r\\n",
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "604f2cdc5b4df626a5a4a85a1b13b9d7f7275fa5",
"protocol_details": {
"payload_preview": "help\\r\\n",
"port": 9136
},
"evidence_snippet": "help\\r\\n",
"attack_vector": "opcua probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0626"
],
"tags_summary_labels_fr": [
"pat-0626"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "help\\r\\n",
"port": 9136
},
"attack_vector": "opcua probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "help\\r\\n",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Payload
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Meta JSON brut
{
"bytes_in": 90,
"payload_entropy": 3.363000349268878,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4af072de9a74c3ed767895a558661d0c",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 44
},
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"evidence": {
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed94629ce2e633cd5b8c5e175091ac0051f3317d",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9136
},
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
WHOAREYOU?
Meta JSON brut
{
"bytes_in": 10,
"payload_entropy": 3.121928094887362,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "762698422aeb434c563df0d64d39eea3",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 33
},
"payload_preview": "WHOAREYOU?",
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"evidence": {
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3787f4d7834468e001a62e09003bd3c666409416",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9136
},
"evidence_snippet": "WHOAREYOU?",
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "WHOAREYOU?",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136 · VNC
|
vnc
|
Sonde VNC
vnc probe · via VNC:9136 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
vnc_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Service
VNC
Payload
RFB 003.003
Pourquoi cette classification : Type « vnc_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
RFB 003.003
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 2.751629167387823,
"port_category": "registered",
"org": "Google LLC",
"service": "vnc",
"app_proto": "vnc",
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 28,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0
},
"risk_score": 34,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "464937eb93d0b00c224d2b60010bf3faaab6f173",
"event_fingerprint": "c3e6144d7717486726413ba4099e8fcb2909cdbd",
"classification_reason": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "vnc",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba4bf75c6ca831dd6ab37a2c5e7413b5",
"path_pattern_hash": "61f146998107ee0d48dcdbbf16d99fc0"
},
"target_context": {
"dst_port": 9136,
"service": "vnc",
"service_name": "vnc",
"risk_score": 34
},
"payload_preview": "RFB 003.003\n",
"request_sample": "RFB 003.003\n",
"payload_snippet": "RFB 003.003",
"evidence": {
"request_sample": "RFB 003.003\n",
"payload_snippet": "RFB 003.003",
"classification_reason": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce04387e7c1aa5c966ccd21cdeb7076d66710e28",
"protocol_details": {
"payload_preview": "RFB 003.003",
"port": 9136,
"service": "vnc",
"service_label_fr": "VNC"
},
"evidence_snippet": "RFB 003.003",
"attack_vector": "vnc probe \u00b7 via VNC:9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "RFB 003.003",
"port": 9136,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "vnc probe \u00b7 via VNC:9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "RFB 003.003",
"target_port_label": "9136 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"vnc_banner"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde SMB
smb probe · port 9136 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0354
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SMB negotiate
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 24,
"payload_entropy": 1.0238995733215064,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0354"
],
"kb_rule_ids": [
"pat-0354"
],
"matched_patterns": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"SMB negotiate",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b54520be3d454f6926b094aac799ac34",
"path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
},
"target_context": {
"dst_port": 9136,
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eff35259e679c95d41c27893f59e0778a93fd264",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9136
},
"attack_vector": "smb probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0354"
],
"tags_summary_labels_fr": [
"pat-0354"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9136
},
"attack_vector": "smb probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
PU:t3://us-l-breens:7001
Meta JSON brut
{
"bytes_in": 60,
"payload_entropy": 4.406669454469437,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 33
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b77198438774258c948ce4c11c9e6d613b55f42a",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9136
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:9136 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Service
MSSQL
Payload
: ! - 1 � MSSQLServer <�
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
pat-0519
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ! - 1 � MSSQLServer <�
Meta JSON brut
{
"bytes_in": 58,
"payload_entropy": 3.4275271990270237,
"port_category": "registered",
"org": "Google LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "71775a6c3930138f5b4a5ab420129615c38203dc",
"event_fingerprint": "0a0f161beb8c871273b6d2c412df90a33156b683",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c254a2e0618be32415a97df79ee8d3b4",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 9136,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c91a2ffe25562c8436c5bd74b9fbd060c472e483",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"port": 9136,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0519",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0519",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"port": 9136,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd",
"target_port_label": "9136 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port 9136/TCP
port 9136 tcp · port 9136 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Preuve honeypot — Sonde port 9136/TCP
Connexion détectée sur le port 9136 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9136_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
GIOP WebSphere IIOP
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
GIOP NameService
Meta JSON brut
{
"bytes_in": 35,
"payload_entropy": 3.4133442623458246,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_9136_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"GIOP WebSphere IIOP",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ee188bd883954b153869cc7ff2dcd2b",
"path_pattern_hash": "f71bced494649ae6c5f34a1c7de9b6a8"
},
"target_context": {
"dst_port": 9136,
"risk_score": 35
},
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"evidence": {
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"classification_reason": "Type \u00ab port_9136_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff7d5ed906a9c6c518c630f4c4abd3284e4c26a5",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9136
},
"evidence_snippet": "GIOPNameService",
"attack_vector": "port 9136 tcp \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9136_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_9136_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9136
},
"attack_vector": "port 9136 tcp \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GIOPNameService",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde Memcached
memcached probe · port 9136 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « memcached_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0374
pat-0533
pat-0865
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Memcached stats
Memcached stats
ET Memcached UDP
User-Agent
—
Règles WAF
—
Payload (extrait)
stats
quit
Meta JSON brut
{
"bytes_in": 15,
"payload_entropy": 2.822579761842491,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 164,
"precision_signals": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"kb_rule_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_patterns": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_pattern_names": [
"Memcached stats",
"Memcached stats",
"ET Memcached UDP"
],
"pattern_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b6167d063664acd0adfde8c56cf6184c",
"path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
},
"target_context": {
"dst_port": 9136,
"risk_score": 50
},
"payload_preview": "stats\r\n\r\nquit\r\n",
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"evidence": {
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5118dd42638aee968fa96a63aebd11b5646fee99",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9136
},
"evidence_snippet": "stats\r\n\r\nquit",
"attack_vector": "memcached probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"tags_summary_labels_fr": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9136
},
"attack_vector": "memcached probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "stats\r\n\r\nquit",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Payload
zal238hcxjky129xz@!*#
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
zal238hcxjky129xz@!*#
Meta JSON brut
{
"bytes_in": 23,
"payload_entropy": 4.262692390839622,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1a1715b3efb95433e20233a8eef266d",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 33
},
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"evidence": {
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30277f2545b9a3eac5ac637afbc4d52d366dfece",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9136
},
"evidence_snippet": "zal238hcxjky129xz@!*#",
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zal238hcxjky129xz@!*#",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde RDP
rdp probe · port 9136 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Payload
*%� Cookie: mstshash=test
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
*%� Cookie: mstshash=test
Meta JSON brut
{
"bytes_in": 42,
"payload_entropy": 3.9214974820450146,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86694eeca7d01319c2e510ca0cdb19fa",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 9136,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0dc2f819edc34f540d5c57926a9f6b5ff3aa7dba",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9136
},
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"attack_vector": "rdp probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9136
},
"attack_vector": "rdp probe \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
envi
quit
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 3.084962500721156,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b66d77430fe371a75bb9845dd40b7d3",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 33
},
"payload_preview": "envi\r\nquit\r\n",
"request_sample": "envi\r\nquit\r\n",
"payload_snippet": "envi\r\nquit",
"evidence": {
"request_sample": "envi\r\nquit\r\n",
"payload_snippet": "envi\r\nquit",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8952ba963a9fecf230e7c3799f38f8c1dbf9a579",
"protocol_details": {
"payload_preview": "envi\r\nquit",
"port": 9136
},
"evidence_snippet": "envi\r\nquit",
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "envi\r\nquit",
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": "envi\r\nquit",
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9136
|
—
|
Sonde port
Sonde port · port 9136 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9136
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9136,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38b8f334118f56d7cc59e03ee8c537d2f5139ae9",
"event_fingerprint": "91489655e9429411b3b52e511f08f2d0f5e2a270",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9136,
"risk_score": 33
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d61afe0682d796b403169e29399f2f5f6d73f1fb",
"protocol_details": {
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"target_port_label": "9136",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9136,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9136
},
"attack_vector": "Sonde port \u00b7 port 9136 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9136",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9136"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8442",
"port:8488",
"port:8831",
"port:8907",
"port:9098"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
PU:t3://us-l-breens:7001
Meta JSON brut
{
"bytes_in": 60,
"payload_entropy": 4.406669454469437,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "351b6558e170bef1ff540b177ce896acb90a7a44",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9098
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
9098
|
—
|
Sonde Memcached
memcached probe · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « memcached_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0374
pat-0533
pat-0865
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Memcached stats
Memcached stats
ET Memcached UDP
User-Agent
—
Règles WAF
—
Payload (extrait)
stats
quit
Meta JSON brut
{
"bytes_in": 15,
"payload_entropy": 2.822579761842491,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 164,
"precision_signals": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"kb_rule_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_patterns": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_pattern_names": [
"Memcached stats",
"Memcached stats",
"ET Memcached UDP"
],
"pattern_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b6167d063664acd0adfde8c56cf6184c",
"path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
},
"target_context": {
"dst_port": 9098,
"risk_score": 50
},
"payload_preview": "stats\r\n\r\nquit\r\n",
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"evidence": {
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "11c3c406433555183d60d4a3f1d9526cef90fce1",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9098
},
"evidence_snippet": "stats\r\n\r\nquit",
"attack_vector": "memcached probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"tags_summary_labels_fr": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9098
},
"attack_vector": "memcached probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "stats\r\n\r\nquit",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Payload
zal238hcxjky129xz@!*#
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
zal238hcxjky129xz@!*#
Meta JSON brut
{
"bytes_in": 23,
"payload_entropy": 4.262692390839622,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1a1715b3efb95433e20233a8eef266d",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"evidence": {
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5bf9c1f8db0b9e2f6f8020b8fba2eb6783288c7",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9098
},
"evidence_snippet": "zal238hcxjky129xz@!*#",
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zal238hcxjky129xz@!*#",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde OPC-UA
opcua probe · port 9098 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « opcua_probe » (signaux protocolaires) · confiance 47%
Confiance classification
65%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0626
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
OPC UA HEL
User-Agent
—
Règles WAF
—
Payload (extrait)
help\r\n
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.75,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 56,
"precision_signals": [
"pat-0626"
],
"kb_rule_ids": [
"pat-0626"
],
"matched_patterns": [
"pat-0626"
],
"matched_pattern_names": [
"OPC UA HEL"
],
"pattern_ids": [
"pat-0626"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ca107f6ced851d3e7dedfb06144f2f1",
"path_pattern_hash": "9665a326f7d8f70f1661dab78807b951"
},
"target_context": {
"dst_port": 9098,
"risk_score": 35
},
"payload_preview": "help\\r\\n",
"request_sample": "help\\r\\n",
"payload_snippet": "help\\r\\n",
"evidence": {
"request_sample": "help\\r\\n",
"payload_snippet": "help\\r\\n",
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f020e3f1702fc90cd21444d1ff1f84dc4c270fe",
"protocol_details": {
"payload_preview": "help\\r\\n",
"port": 9098
},
"evidence_snippet": "help\\r\\n",
"attack_vector": "opcua probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0626"
],
"tags_summary_labels_fr": [
"pat-0626"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "help\\r\\n",
"port": 9098
},
"attack_vector": "opcua probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "help\\r\\n",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port 9098/TCP
port 9098 tcp · port 9098 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Preuve honeypot — Sonde port 9098/TCP
Connexion détectée sur le port 9098 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9098_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
GIOP WebSphere IIOP
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
GIOP NameService
Meta JSON brut
{
"bytes_in": 35,
"payload_entropy": 3.4133442623458246,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_reason": "Type \u00ab port_9098_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"GIOP WebSphere IIOP",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ee188bd883954b153869cc7ff2dcd2b",
"path_pattern_hash": "a4c9cf2f08537aaf555281da89aaefc1"
},
"target_context": {
"dst_port": 9098,
"risk_score": 35
},
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"evidence": {
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"classification_reason": "Type \u00ab port_9098_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d106ca340cfaea076b2a774c0c234d72134ddbf",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9098
},
"evidence_snippet": "GIOPNameService",
"attack_vector": "port 9098 tcp \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9098_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_9098_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9098
},
"attack_vector": "port 9098 tcp \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GIOPNameService",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
envi
quit
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 3.084962500721156,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b66d77430fe371a75bb9845dd40b7d3",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"payload_preview": "envi\r\nquit\r\n",
"request_sample": "envi\r\nquit\r\n",
"payload_snippet": "envi\r\nquit",
"evidence": {
"request_sample": "envi\r\nquit\r\n",
"payload_snippet": "envi\r\nquit",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca279e2a6500ff58440890a2d02fb738a503912f",
"protocol_details": {
"payload_preview": "envi\r\nquit",
"port": 9098
},
"evidence_snippet": "envi\r\nquit",
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "envi\r\nquit",
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "envi\r\nquit",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Payload
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Meta JSON brut
{
"bytes_in": 90,
"payload_entropy": 3.363000349268878,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4af072de9a74c3ed767895a558661d0c",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"evidence": {
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcd806f66ecec5cac7f32d38cc7ead2b67e157f2",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9098
},
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde RDP
rdp probe · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Payload
*%� Cookie: mstshash=test
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
*%� Cookie: mstshash=test
Meta JSON brut
{
"bytes_in": 42,
"payload_entropy": 3.9214974820450146,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86694eeca7d01319c2e510ca0cdb19fa",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 9098,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7348604f6dd0222e5555b0efaa4b0a0d0c49d51",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9098
},
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"attack_vector": "rdp probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9098
},
"attack_vector": "rdp probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098 · VNC
|
vnc
|
Sonde VNC
vnc probe · via VNC:9098 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
vnc_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Service
VNC
Payload
RFB 003.003
Pourquoi cette classification : Type « vnc_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
RFB 003.003
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 2.751629167387823,
"port_category": "registered",
"org": "Google LLC",
"service": "vnc",
"app_proto": "vnc",
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 28,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0
},
"risk_score": 34,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "4adda1d925152947161d9dc967ea2adc3aae98fc",
"event_fingerprint": "8a1ba720664e53744c202e735970910277378388",
"classification_reason": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "vnc",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba4bf75c6ca831dd6ab37a2c5e7413b5",
"path_pattern_hash": "61f146998107ee0d48dcdbbf16d99fc0"
},
"target_context": {
"dst_port": 9098,
"service": "vnc",
"service_name": "vnc",
"risk_score": 34
},
"payload_preview": "RFB 003.003\n",
"request_sample": "RFB 003.003\n",
"payload_snippet": "RFB 003.003",
"evidence": {
"request_sample": "RFB 003.003\n",
"payload_snippet": "RFB 003.003",
"classification_reason": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8d229d2034fb42d7adb6fe913dd10cdca5e99ae",
"protocol_details": {
"payload_preview": "RFB 003.003",
"port": 9098,
"service": "vnc",
"service_label_fr": "VNC"
},
"evidence_snippet": "RFB 003.003",
"attack_vector": "vnc probe \u00b7 via VNC:9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 28,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "RFB 003.003",
"port": 9098,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "vnc probe \u00b7 via VNC:9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "RFB 003.003",
"target_port_label": "9098 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"vnc_banner"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
WHOAREYOU?
Meta JSON brut
{
"bytes_in": 10,
"payload_entropy": 3.121928094887362,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "762698422aeb434c563df0d64d39eea3",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"payload_preview": "WHOAREYOU?",
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"evidence": {
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd9a27a72b97c3ab90e2b02b11d928c9cf8647fc",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9098
},
"evidence_snippet": "WHOAREYOU?",
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "WHOAREYOU?",
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:9098 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Service
MSSQL
Payload
: ! - 1 � MSSQLServer <�
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
pat-0519
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ! - 1 � MSSQLServer <�
Meta JSON brut
{
"bytes_in": 58,
"payload_entropy": 3.4275271990270237,
"port_category": "registered",
"org": "Google LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "691034e183524b5d4782c55e70140f5c4df47b5e",
"event_fingerprint": "b45d08dfe66cbe19cb8c0a5ab02a460d7c0842cc",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c254a2e0618be32415a97df79ee8d3b4",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 9098,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a64d27fa28cfe3bb4e7f36da396e870ec5305e3a",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"port": 9098,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0519",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0519",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000",
"port": 9098,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd",
"target_port_label": "9098 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde SMB
smb probe · port 9098 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0354
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SMB negotiate
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 24,
"payload_entropy": 1.0238995733215064,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0354"
],
"kb_rule_ids": [
"pat-0354"
],
"matched_patterns": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"SMB negotiate",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b54520be3d454f6926b094aac799ac34",
"path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
},
"target_context": {
"dst_port": 9098,
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5559241158ad25a47653d0fdab0519fb3d009f6",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9098
},
"attack_vector": "smb probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0354"
],
"tags_summary_labels_fr": [
"pat-0354"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9098
},
"attack_vector": "smb probe \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 2,
"payload_entropy": 1,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7eb70257593da06f682a3ddda54a9d26",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"payload_preview": "\r\n",
"request_sample": "\r\n",
"evidence": {
"request_sample": "\r\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ffe934eb3ba9a0ecb70bdafb5e8f81b8dbb2ac87",
"protocol_details": {
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9098
|
—
|
Sonde port
Sonde port · port 9098 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9098
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc64e693665e91d15834fc62a0f4820684dd18ba",
"event_fingerprint": "893616fbdda04b61b637e7d9654544d23ccb0a21",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9098,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93870153e11706a92c12b53466ed6a90d21d96e6",
"protocol_details": {
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"target_port_label": "9098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9098
},
"attack_vector": "Sonde port \u00b7 port 9098 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"consul",
"github-webhook",
"mssql",
"port:8420",
"port:8426",
"port:8442",
"port:8488",
"port:8831"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
github webhook abuse
github webhook abuse · via Webhook GitHub:9011 · (tentative d'exploit)
|
Élevée
|
Faible · 32
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
zal238hcxjky129xz@!*#
Pourquoi cette classification : Type « github_webhook_abuse » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 32
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
zal238hcxjky129xz@!*#
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 23,
"payload_entropy": 4.262692390839622,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 40,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1a1715b3efb95433e20233a8eef266d",
"path_pattern_hash": "3a1138cde939a3dbf37a222ea59ef72a"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 32
},
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"evidence": {
"request_sample": "\u0000\u0015zal238hcxjky129xz@!*#",
"payload_snippet": "\u0000\u0015zal238hcxjky129xz@!*#",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0914403824877644fd3416603eb2cf205f90219a",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "zal238hcxjky129xz@!*#",
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 32\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 18 % \u2014 via Webhook GitHub \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0015zal238hcxjky129xz@!*#",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"evidence_snippet": "zal238hcxjky129xz@!*#",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Sonde port 9011/TCP
port 9011 tcp · via Webhook GitHub:9011 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Preuve honeypot — Sonde port 9011/TCP
Connexion détectée sur le port 9011 (TCP) du capteur simulé.
Service
Webhook GitHub
Payload
GIOP NameService
Pourquoi cette classification : Type « port_9011_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Moyen
· 41
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
GIOP WebSphere IIOP
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
GIOP NameService
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 35,
"payload_entropy": 3.4133442623458246,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab port_9011_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"GIOP WebSphere IIOP",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 41,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "github-webhook",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ee188bd883954b153869cc7ff2dcd2b",
"path_pattern_hash": "eb0c02b694be95cbd5e3c1eddd6e8acd"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 41
},
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"evidence": {
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"classification_reason": "Type \u00ab port_9011_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "47dfc5068ff089f7eb9c2c0c2c935de58bf408cf",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "GIOPNameService",
"attack_vector": "port 9011 tcp \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9011_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_9011_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 41,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port 9011 tcp \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GIOPNameService",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Sonde SMB
smb probe · via Webhook GitHub:9011 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0354
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SMB negotiate
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 24,
"payload_entropy": 1.0238995733215064,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0354"
],
"kb_rule_ids": [
"pat-0354"
],
"matched_patterns": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"SMB negotiate",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0354",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b54520be3d454f6926b094aac799ac34",
"path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e138530568ebab25d72cec03e424a94308dfce1",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "smb probe \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"pat-0354"
],
"tags_summary_labels_fr": [
"pat-0354"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "smb probe \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
github webhook abuse
github webhook abuse · via Webhook GitHub:9011 · (tentative d'exploit)
|
Élevée
|
Moyen · 43
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Pourquoi cette classification : Type « github_webhook_abuse » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
Z :8 �� : AA (CONNECT_DATA=(COMMAND=VERSION))
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 90,
"payload_entropy": 3.363000349268878,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 40,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 43,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 43,
"correlation_boost": 18
},
"service_name": "github-webhook",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4af072de9a74c3ed767895a558661d0c",
"path_pattern_hash": "3a1138cde939a3dbf37a222ea59ef72a"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 43
},
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"evidence": {
"request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ebf16b27d94c6ca6901b574cc98f7d9b0a38f3ba",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 68 % \u2014 via Webhook GitHub \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Sonde RDP
rdp probe · via Webhook GitHub:9011 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Investiguer
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
*%� Cookie: mstshash=test
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
*%� Cookie: mstshash=test
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 42,
"payload_entropy": 3.9214974820450146,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 50,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86694eeca7d01319c2e510ca0cdb19fa",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fc09d6a5be30eafc2029a5ee946f04ac3fde59a",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"attack_vector": "rdp probe \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "rdp probe \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*%\ufffdCookie: mstshash=test",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
github webhook abuse
github webhook abuse · via Webhook GitHub:9011 · (tentative d'exploit)
|
Élevée
|
Faible · 32
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
WHOAREYOU?
Pourquoi cette classification : Type « github_webhook_abuse » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 32
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
WHOAREYOU?
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 10,
"payload_entropy": 3.121928094887362,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 40,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "762698422aeb434c563df0d64d39eea3",
"path_pattern_hash": "3a1138cde939a3dbf37a222ea59ef72a"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 32
},
"payload_preview": "WHOAREYOU?",
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"evidence": {
"request_sample": "WHOAREYOU?",
"payload_snippet": "WHOAREYOU?",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cbf3c28f64bac8d3d16aae095d197829b772d73",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "WHOAREYOU?",
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 32\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 18 % \u2014 via Webhook GitHub \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "WHOAREYOU?",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"evidence_snippet": "WHOAREYOU?",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Sonde Memcached
memcached probe · via Webhook GitHub:9011 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Investiguer
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
stats quit
Pourquoi cette classification : Type « memcached_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0374
pat-0533
pat-0865
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Memcached stats
Memcached stats
ET Memcached UDP
User-Agent
—
Règles WAF
—
Payload (extrait)
stats
quit
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 15,
"payload_entropy": 2.822579761842491,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 50,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 164,
"precision_signals": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"kb_rule_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_patterns": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_pattern_names": [
"Memcached stats",
"Memcached stats",
"ET Memcached UDP"
],
"pattern_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b6167d063664acd0adfde8c56cf6184c",
"path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 50
},
"payload_preview": "stats\r\n\r\nquit\r\n",
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"evidence": {
"request_sample": "stats\r\n\r\nquit\r\n",
"payload_snippet": "stats\r\n\r\nquit",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22404da8898222eba339cf7f40839546239110e7",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "stats\r\n\r\nquit",
"attack_vector": "memcached probe \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"tags_summary_labels_fr": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "stats\r\n\r\nquit",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "memcached probe \u00b7 via Webhook GitHub:9011 \u00b7 (sonde \/ probe)",
"evidence_snippet": "stats\r\n\r\nquit",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
github webhook abuse
github webhook abuse · via Webhook GitHub:9011 · (tentative d'exploit)
|
Élevée
|
Faible · 32
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001
Pourquoi cette classification : Type « github_webhook_abuse » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 32
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
PU:t3://us-l-breens:7001
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 60,
"payload_entropy": 4.406669454469437,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 40,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c455bad8a29de7905ce143c26bce738398091e97",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8",
"path_pattern_hash": "3a1138cde939a3dbf37a222ea59ef72a"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 32
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f63e4e0f2f1f87c283349d969114252c420a083d",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 32\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 18 % \u2014 via Webhook GitHub \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 40,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"consul",
"github-webhook",
"http",
"mssql",
"port:8249",
"port:8420",
"port:8426",
"port:8442"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_github_webhook_abuse"
],
"asn_dc_heuristic": true
}
|