Renseignement sur les menaces

États-Unis

34.19.127.180

FAI Google LLC Première vue 30/07/2026 18:28 UTC Dernière vue 01/08/2026 09:04 UTC Risque Élevé

Période analysée : 2026-07-03 → 2026-08-02

Activité suspecte — risque 54/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (46 protocoles · 5 min)

Campagne de scan — plusieurs IP du même /24 (34.19.127.0/24, ≥3 pairs)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Élevé · Risque max (7j) Élevé

Synthèse exécutive

Profil de menace

Score de risque 83/100 Élevé

Première observation 30/07/2026 18:28 UTC

Dernière observation 01/08/2026 09:04 UTC

Événements (période) 4,153

MITRE ATT&CK principal T1046 3704 occurrences

Activité suspecte — risque 54/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (46 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 72 · Bonus corrélation +24 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 396982 · 34.19.0.0/17 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 4,153 événements sur la période pour cette IP.

147.185.133.240 Scanner web 02/08/2026 04:26 UTC
147.185.133.230 Scanner web 02/08/2026 04:24 UTC
198.235.24.162 Sonde port 02/08/2026 04:20 UTC
147.185.132.103 Scanner web 02/08/2026 04:19 UTC
162.216.150.123 Scanner web 02/08/2026 04:18 UTC
162.216.150.178 Scanner web 02/08/2026 04:18 UTC
147.185.132.138 Sonde SAP ICM HTTP 02/08/2026 04:17 UTC
162.216.149.34 Scanner web 02/08/2026 04:16 UTC

Événements (filtres)

4,153

Première observation

30/07/2026 18:28 UTC

Dernière observation

01/08/2026 09:04 UTC

Dernière activité (filtres)

01/08/2026 09:04 UTC

Événements 7j

4,153

Ports distincts (7j)

291

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 2,039 HTTP TCP 914 WEBLOGIC CLUSTER TCP 64 WINRM TCP 31 HTTP ALT 8001 TCP 27 SAP MS TCP 26 DEVOPS PROBE TCP 26 PROFINET TCP 26 TOR OR TCP 25 FTP TCP 17 CLICKHOUSE HTTP TCP 16 FLASK HTTP TCP 16 HTTP ALT 8040 TCP 16 CONSUL SERVER TCP 16 KUBELET READONLY TCP 15 QOTD TCP 15 HTTP ALT 81 TCP 15 MSMQ TCP 15 LDAP TCP 15 RDP TCP 15

TLS

2,039

HTTP

914

WEBLOGIC CLUSTER

WINRM

HTTP ALT 8001

SAP MS

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Google LLC 0 Port 8104 port_scan_syn

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:8040 · (reconnaissance)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0…

Aperçu payload

GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8040 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac

Port / service

8040 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 3 tag(s) WAF

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +24

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

4,153 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

4153 événement(s) — page 1/84

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
01/08/2026 09:04:03 UTC	TCP	8040 · HTTP	http	Scan de ports port scan syn · via HTTP:8040 · (reconnaissance)	Élevée	Moyen · 54
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_port_scan_slow Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8040 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 54 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8040 Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac Requête brute (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8040 Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c", "http_host_hash": "ef70bfd6e2bb5526cc8d8ebb452ffb26b3b43dba", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 216, "payload_entropy": 5.393380860272721, "port_category": "registered", "org": "Google LLC", "service": "http", "app_proto": "http", "asn": 396982, "country": "US", "dst_port": 8040, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 54, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d3665fd44a919180f1d0d0a2cf675fd0bd40942e", "event_fingerprint": "6b48df12f748b1fa3e8f3ce127735f04dd41e370", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0324" ], "matched_pattern_names": [ "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 54, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "2994862c1f8176879ed381354c9dd245", "payload_hash": "e17b308f16d5c43caf9fccc3db255159", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8040, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "840c4b78765e6dcc8a172b7fd78afbf5a2f7a475", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36", "port": 8040, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "attack_vector": "port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)", "target_port_label": "8040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 54, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8040, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36", "port": 8040, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "target_port_label": "8040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8040" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8040, 8104, 8764, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 27, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_slow" ], "asn_dc_heuristic": true }
01/08/2026 09:03:58 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 67625c3bd21c0996 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��ȱd/��=�mƞdQ�1��B�]N�i�h�F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��ȱd/��=�mƞdQ�1��B�]N�i�h�F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��ȱd/��=�mƞdQ�1��B�]N�i�h�F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "67625c3bd21c099689690498fb5b754e", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.854808876796342, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "fbeab806823ea7dbe6877067c74b41bbbeb03f40", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "67625c3bd21c099689690498fb5b754e", "payload_hash": "25ca286a24a83bffb77136e29e3302f0", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0301", "tls_cipher_count": 35, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\u0003h\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\u0003h\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\u0003h\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "27cc1c3dcb716b11bc65d0c740145089c20e6457", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\u0003h\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffdh\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\u0003h\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffdh\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 27, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:58 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1efa91265313b060 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ZV+MK_Z}z��F?k�؜��ݷ��:�oS]X%��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZV+MK_Z}z��F?k�؜��ݷ��:�oS]X%��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZV+MK_Z}z��F?k�؜��ݷ��:�oS]X%��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 351, "payload_entropy": 5.365909426016082, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "c25b072c6f74464586342ab7e5ef608a48a5a2c3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1efa91265313b0607d774cf0cdfebe64", "payload_hash": "424b1132976b3cd2fd7782537c371bb9", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003+MK_Z}z\ufffd\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\u001f]X%\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003+MK_Z}z\ufffd\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\u001f]X%\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003+MK_Z}z\ufffd\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\u001f]X%\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1713a3f88e18e96059053e09eff7b5183c8feec2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003+MK_Z}z\ufffd\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\u001f]X%\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "ZV+MK_Z}z\ufffd\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS]X%\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003+MK_Z}z\ufffd\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\u001f]X%\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "ZV+MK_Z}z\ufffd\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS]X%\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 27, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:58 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��Jyu^}�x��ː��ƌ��Q-� Yb�F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Jyu^}�x��ː��ƌ��Q-�Yb�F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��Jyu*^}�x��ː��ƌ��Q-� Yb�F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.899952502681429, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "aebb1c8c0cf0c9e93f179c2ca502301c3c4948c8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "payload_hash": "ecfca8de30d37b38923bd7d0cb2e2033", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "ja3_client_category": "browser_like", "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdJy\u0016u\u001c^}\ufffd\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\fYb\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdJy\u0016u\u001c^}\ufffd\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\fYb\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdJy\u0016u\u001c^}\ufffd\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\fYb\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcb0804fdb4b7667bb7c1860b4f48bd2b98f0da5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdJy\u0016u\u001c^}\ufffd\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\fYb\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdJyu^}\ufffdx\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffdYb\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdJy\u0016u\u001c^}\ufffd\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\fYb\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdJyu*^}\ufffdx\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffdYb\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 27, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:57 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 8946c511138b1239 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��jm�~�Hs۩�Im?�� ݑj�&$p�� H+#��LmV.��ߑ�=)$�r��P�HB f 62.3.50.33 # 0 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��jm�~�Hs۩�Im?�� ݑj�&$p�� H+#��LmV.��ߑ�=)$�r��P�HB f 62.3.50.33# 0 Requête brute (extrait) ��jm�~�Hs۩�Im?�� ݑj�&$p�� H+#��LmV.��ߑ�=)$�r��P�HB f 62.3.50.33 # 0. �c�3�� (?$�wq�,��.߶{(�Ke�%Ot��p͈� Meta JSON brut { "tls_ja3_hash": "8946c511138b12399488b08a5f1b3ae2", "tls_sni": "62.3.50.33", "bytes_in": 1474, "payload_entropy": 7.76402089896983, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "eb2a46ead43c63344da5490801925b4471b834a8", "event_fingerprint": "11ec28d70ecdf5d32404d9fcfe279bd8241e556f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "8946c511138b12399488b08a5f1b3ae2", "payload_hash": "9590cab751d712127d73b4cd564ac12d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 (?\u0011\u001f$\ufffdwq\ufffd\u001b\u0012,\ufffd\ufffd\ufffd\u001f\ufffd.\u0003\u0011\u07f6{(\ufffdKe\ufffd%Ot\u0011\ufffd\u0004\ufffd\ufffdp\u0348\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7a3bc76dad7706d449efbd4bb3ce67a50ec114e0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "tls_ja3": "8946c511138b12399488b08a5f1b3ae2", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\nf\r\n62.3.50.33#\r0", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "tls_ja3": "8946c511138b12399488b08a5f1b3ae2", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\nf\r\n62.3.50.33#\r0", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip" ], "asn_dc_heuristic": true }
01/08/2026 09:03:57 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 de8c366fbb06bedc SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��U%aw�<��7c�3��m <��!Ci�>\R-L ).�U�]�O��L�<�q�\|��5�z�T� m 62.3.50.33 � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��U%aw�<��7c�3��m<��!Ci�>\R-L ).�U�]�O��L�<�q�\|��5�z�T� m 62.3.50.33 � Requête brute (extrait) ��U%aw�<��7c�3��m <��!Ci�>\R-L ).�U�]�O��L�<�q�\|��5�z�T� m 62.3.50.33 �# ( +-3��p�;� �x�� u,B�fѱZ$%~I�& Meta JSON brut { "tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "bytes_in": 1481, "payload_entropy": 7.7173996377811465, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "eb2a46ead43c63344da5490801925b4471b834a8", "event_fingerprint": "adbdb758a163d56bf5128527c97bb590e97efb44", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "de8c366fbb06bedcd7b86ddda1addac6", "payload_hash": "98462db1453e6bfe8c61191e22ec8d2e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015\ufffd\ufffdU%aw\ufffd<\ufffd\u0018\ufffd7c\ufffd3\ufffd\ufffdm\u000b<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd\u0000]\ufffdO\ufffd\ufffd\u0017L\ufffd<\ufffdq\ufffd\|\u000e\ufffd\ufffd5\ufffdz\ufffdT\u000f\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015\ufffd\ufffdU%aw\ufffd<\ufffd\u0018\ufffd7c\ufffd3\ufffd\ufffdm\u000b<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd\u0000]\ufffdO\ufffd\ufffd\u0017L\ufffd<\ufffdq\ufffd\|\u000e\ufffd\ufffd5\ufffdz\ufffdT\u000f\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdp\ufffd;\ufffd\r\u0006\ufffdx\u0001\ufffd\ufffd\u0001\u0001\ufffd \u0015\u0006u,B\ufffdf\u0471Z$\u0007%~I\ufffd&", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015\ufffd\ufffdU%aw\ufffd<\ufffd\u0018\ufffd7c\ufffd3\ufffd\ufffdm\u000b<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd\u0000]\ufffdO\ufffd\ufffd\u0017L\ufffd<\ufffdq\ufffd\|\u000e\ufffd\ufffd5\ufffdz\ufffdT\u000f\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b070530627cc19da5631ccaddd3f7d072ed4701", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015\ufffd\ufffdU%aw\ufffd<\ufffd\u0018\ufffd7c\ufffd3\ufffd\ufffdm\u000b<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd\u0000]\ufffdO\ufffd\ufffd\u0017L\ufffd<\ufffdq\ufffd\|\u000e\ufffd\ufffd5\ufffdz\ufffdT\u000f\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdU%aw\ufffd<\ufffd\ufffd7c\ufffd3\ufffd\ufffdm<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd]\ufffdO\ufffd\ufffdL\ufffd<\ufffdq\ufffd\|\ufffd\ufffd5\ufffdz\ufffdT\ufffd\nm\r\n62.3.50.33\n\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015\ufffd\ufffdU%aw\ufffd<\ufffd\u0018\ufffd7c\ufffd3\ufffd\ufffdm\u000b<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd\u0000]\ufffdO\ufffd\ufffd\u0017L\ufffd<\ufffdq\ufffd\|\u000e\ufffd\ufffd5\ufffdz\ufffdT\u000f\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdU%aw\ufffd<\ufffd\ufffd7c\ufffd3\ufffd\ufffdm<\ufffd\ufffd!Ci\ufffd>\\R-L ).\ufffdU\ufffd*]\ufffdO\ufffd\ufffdL\ufffd<\ufffdq\ufffd\|\ufffd\ufffd5\ufffdz\ufffdT\ufffd\nm\r\n62.3.50.33\n\ufffd", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip" ], "asn_dc_heuristic": true }
01/08/2026 09:03:57 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 3947c3d16bc8cd21 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��̳!b�}�pO��ʨ �7��q� �^�ȟb�"?ٴ� ��{��b�7]+w��`��s��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello User-Agent — Règles WAF — Payload (extrait) ��̳!b�}�pO��ʨ�7��q� �^�ȟb�"?ٴ� ��{��b�7]+w��`��s��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��̳!b�}�pO��ʨ �7��q� �^�ȟb�"?ٴ� ��{��b�7]+w��`��s��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5 Meta JSON brut { "tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 1695, "payload_entropy": 7.599532275182358, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "ea7e29b209fc2a99a733eb7a953aff2d8c532df1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello" ], "pattern_ids": [ "pat-0554", "pat-0578" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "payload_hash": "41085633cf921a59077848264d40a653", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\u0015p\u0014O\ufffd\ufffd\ufffd\u0015\u02a8\f\u001e\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\u0000\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\u0015p\u0014O\ufffd\ufffd\ufffd\u0015\u02a8\f\u001e\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\u0000\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\u0015p\u0014O\ufffd\ufffd\ufffd\u0015\u02a8\f\u001e\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\u0000\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7ad63d8382ec2ff697c5b32b837ff4691535e84e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\u0015p\u0014O\ufffd\ufffd\ufffd\u0015\u02a8\f\u001e\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\u0000\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffdpO\ufffd\ufffd\ufffd\u02a8\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\u0015p\u0014O\ufffd\ufffd\ufffd\u0015\u02a8\f\u001e\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\u0000\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffdpO\ufffd\ufffd\ufffd\u02a8\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\ufffd\u021fb\ufffd\"?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:56 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��1��W�:��\|�S�s��%��u��^F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��1��W�:��\|�S�s��%��u��^F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��1��W�:��\|�S�s��%��u��^F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.879896645513846, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "aebb1c8c0cf0c9e93f179c2ca502301c3c4948c8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "payload_hash": "2f6fe24527422867a1fc839cf97e86c3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "ja3_client_category": "browser_like", "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\u0014\ufffds\u0012\ufffd\u0019\ufffd%\ufffd\ufffd\ufffd\u0006u\u001f\ufffd\ufffd\u001f^\u001e\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\u0014\ufffds\u0012\ufffd\u0019\ufffd%\ufffd\ufffd\ufffd\u0006u\u001f\ufffd\ufffd\u001f^\u001e\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\u0014\ufffds\u0012\ufffd\u0019\ufffd%\ufffd\ufffd\ufffd\u0006u\u001f\ufffd\ufffd\u001f^\u001e\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f6f2a46bb5aaa6e31f1a7299cb60c7625031476b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\u0014\ufffds\u0012\ufffd\u0019\ufffd%\ufffd\ufffd\ufffd\u0006u\u001f\ufffd\ufffd\u001f^\u001e\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\ufffds\ufffd\ufffd%\ufffd\ufffd\ufffdu\ufffd\ufffd^F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\u0014\ufffds\u0012\ufffd\u0019\ufffd%\ufffd\ufffd\ufffd\u0006u\u001f\ufffd\ufffd\u001f^\u001e\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd\|\ufffdS\ufffds\ufffd\ufffd%\ufffd\ufffd\ufffdu\ufffd\ufffd^F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:56 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 4ae33de1ad939562 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�~�Hs۩�Im?�� ݑj�&$p�� H+#��LmV.��ߑ�=)$�r��P�HB� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�~�Hs۩�Im?�� ݑj�&$p�� H+#��LmV.��ߑ�=)$�r��P�HB� Requête brute (extrait) ~zjm�~�Hs۩�Im?�� ݑj�&$p�� H+#��LmV.��ߑ�=)$�r��P�HB� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.720055676364848, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "5e42777f53c76cc97b7e6c8807d1ef4c2e33d77e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "4ae33de1ad93956213297c61748ec996", "payload_hash": "03705e2812a4777c9a1465e7c7bb9623", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c7a6deab36c72f4f98d25fa0c6b374175e55e0ad", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffd~\ufffdH\u0014s\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$\u0000\u001cp\ufffd\ufffd \ufffd\ufffdH+#\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\u0017\ufffdr\ufffd\ufffdP\ufffdHB\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\t\u0751j\ufffd&$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\ufffd", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:56 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1efa91265313b060 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ZV\L��6��uxV� ��z��{��Q�p��&��z��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZV\L��6��uxV��z��{��Q�p��&��z��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZV\L��6��uxV� ��z��{��Q�p��&��z��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 351, "payload_entropy": 5.351628730842958, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "c25b072c6f74464586342ab7e5ef608a48a5a2c3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1efa91265313b0607d774cf0cdfebe64", "payload_hash": "a90062fa21bb7fab7f607cab61911bf5", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\\L\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\u0012\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\\L\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\u0012\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\\L\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\u0012\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cf9238637e2b888d83d23a6a33f603e1b0637087", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\\L\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\u0012\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "ZV\\L\ufffd\ufffd6\ufffd\ufffduxV\ufffd\ufffd\ufffdz\ufffd\ufffd{\ufffd\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\\L\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\u0012\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "ZV\\L\ufffd\ufffd6\ufffd\ufffduxV\ufffd\ufffd\ufffdz\ufffd\ufffd{\ufffd\ufffdQ\ufffdp\ufffd\ufffd&\ufffd\ufffd\ufffdz\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:55 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS Payload �� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) �� Meta JSON brut { "tls_ja3_hash": null, "tls_sni": null, "bytes_in": 11, "payload_entropy": 2.2221915755066783, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 23, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 23, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "18bc19c3c9c826abb4bc2f2aa9f427077485a572", "event_fingerprint": "a6f2ac07f40742e1f9b0fb17bf4ebb71ebcf5956", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 23, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "55b6c6b63391f7a244877208a3a6144c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "evidence": { "request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5cbda4e4e92df7608f23466cb60e677116802835", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 23, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.82, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_no_sni" ], "asn_dc_heuristic": true }
01/08/2026 09:03:55 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 e53406bbb3118b0c SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�\|�Hwۧ�Im=�� ݑh�&$�p�� H)%۾�LmT0��ߑ?)$�r��R�H@� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�\|�Hwۧ�Im=��ݑh�&$�p�� H)%۾�LmT0��ߑ?)$�r��R�H@� Requête brute (extrait) ~zjm�\|�Hwۧ�Im=�� ݑh�&$�p�� H)%۾�LmT0��ߑ?)$�r��R�H@� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "e53406bbb3118b0c8a662f6717ac159d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.74427253697689, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "a69c3559900973b5d4076fa87cb72834ab3e9971", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "e53406bbb3118b0c8a662f6717ac159d", "payload_hash": "699cc9664b1f380d08a9f23ed07cf10e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffd\|\ufffdH\u0012w\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u000b\u0751h\ufffd&$\ufffd\u001ep\ufffd\ufffd \ufffd\ufffdH)%\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\u0015\ufffdr\ufffd\ufffdR\ufffdH@\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffd\|\ufffdH\u0012w\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u000b\u0751h\ufffd&$\ufffd\u001ep\ufffd\ufffd \ufffd\ufffdH)%\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\u0015\ufffdr\ufffd\ufffdR\ufffdH@\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffd\|\ufffdH\u0012w\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u000b\u0751h\ufffd&$\ufffd\u001ep\ufffd\ufffd \ufffd\ufffdH)%\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\u0015\ufffdr\ufffd\ufffdR\ufffdH@\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1406fa6ca78f9339146bd84d07444a87dc126b2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffd\|\ufffdH\u0012w\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u000b\u0751h\ufffd&$\ufffd\u001ep\ufffd\ufffd \ufffd\ufffdH)%\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\u0015\ufffdr\ufffd\ufffdR\ufffdH@\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "e53406bbb3118b0c8a662f6717ac159d", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffd\|\ufffdHw\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u0751h\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH)%\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\ufffdr\ufffd\ufffdR\ufffdH@\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffd\|\ufffdH\u0012w\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u000b\u0751h\ufffd&$\ufffd\u001ep\ufffd\ufffd \ufffd\ufffdH)%\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\u0015\ufffdr\ufffd\ufffdR\ufffdH@\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "e53406bbb3118b0c8a662f6717ac159d", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffd\|\ufffdHw\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u0751h\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH)%\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\ufffdr\ufffd\ufffdR\ufffdH@\ufffd", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.82, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:55 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 67625c3bd21c0996 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��:�W�u�1@b�� &��jD�Y=��W�F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��:�W�u�1@b��&��jD�Y=��W�F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��:�W�u�1@b�� &��jD�Y=��W�F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "67625c3bd21c099689690498fb5b754e", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.844288569200092, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "fbeab806823ea7dbe6877067c74b41bbbeb03f40", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "67625c3bd21c099689690498fb5b754e", "payload_hash": "3bd6f99f9ef19af1598b84ea812eca5c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0301", "tls_cipher_count": 35, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\f\ufffd\ufffd\f&\ufffd\ufffd\ufffd\ufffdj\u0004D\ufffdY=\ufffd\ufffdW\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\f\ufffd\ufffd\f&\ufffd\ufffd\ufffd\ufffdj\u0004D\ufffdY=\ufffd\ufffdW\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\f\ufffd\ufffd\f&\ufffd\ufffd\ufffd\ufffdj\u0004D\ufffdY=\ufffd\ufffdW\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa605104acae0a33961512543bbb3745dd8e5527", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\f\ufffd\ufffd\f&\ufffd\ufffd\ufffd\ufffdj\u0004D\ufffdY=\ufffd\ufffdW\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffdjD\ufffdY=\ufffd\ufffdW\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\f\ufffd\ufffd\f&\ufffd\ufffd\ufffd\ufffdj\u0004D\ufffdY=\ufffd\ufffdW\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffdjD\ufffdY=\ufffd\ufffdW\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:55 UTC	TCP	9054 · TLS	tls	Scan de ports port scan syn · via TLS:9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1196e3b1fa255a44 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�}�Hwۨ�Im>�� ݑi�&$�p�� H$ۿ�LmU/��ߑ�>)$�r��Q�HA� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�}�Hwۨ�Im>�� ݑi�&$�p�� H$ۿ�LmU/��ߑ�>)$�r��Q�HA� Requête brute (extrait) ~zjm�}�Hwۨ�Im>�� ݑi�&$�p�� H$ۿ�LmU/��ߑ�>)$�r��Q�HA� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "1196e3b1fa255a444a88617c122e45a5", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.737295878392577, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "14daed23e9b9240911a6da19b24dd2b1610dc182", "event_fingerprint": "88a610d079aebae8a477000cd8603c110effae4a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1196e3b1fa255a444a88617c122e45a5", "payload_hash": "2d86cf14143f032f68932d1457964fc8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9054, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffd}\ufffdH\u0013w\u0000\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffd\u001dp\ufffd\ufffd \ufffd\ufffdH$\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffd}\ufffdH\u0013w\u0000\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffd\u001dp\ufffd\ufffd \ufffd\ufffdH$\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffd}\ufffdH\u0013w\u0000\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffd\u001dp\ufffd\ufffd \ufffd\ufffdH$\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dbaa74553cd7a8621f6af02832650924310aa512", "protocol_details": { "payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffd}\ufffdH\u0013w\u0000\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffd\u001dp\ufffd\ufffd \ufffd\ufffdH$\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "1196e3b1fa255a444a88617c122e45a5", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffd}\ufffdHw\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH$\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\ufffdr\ufffd\ufffdQ\ufffdHA\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffd}\ufffdH\u0013w\u0000\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffd\u001dp\ufffd\ufffd \ufffd\ufffdH$\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "1196e3b1fa255a444a88617c122e45a5", "tls_sni": "62.3.50.33", "port": 9054, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffd}\ufffdHw\u06e8\ufffdIm>\ufffd\ufffd\ufffd\ufffd\n\u0751i\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH*$\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd>)$\ufffdr\ufffd\ufffdQ\ufffdHA\ufffd", "target_port_label": "9054 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.61, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:54 UTC	TCP	9054	—	Scan de ports port scan syn · port 9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "2f4e07a59138df32e3fbb8195c3054bc42d757e7", "event_fingerprint": "0e748a364441305f623548cd87ecfbe60d61dc11", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9054, "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c74aebc91d81f35e3684b594cc4221aa0cdb76d9", "protocol_details": { "port": 9054 }, "attack_vector": "port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)", "target_port_label": "9054", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9054 }, "attack_vector": "port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9054", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
01/08/2026 09:03:54 UTC	TCP	9054	—	Scan de ports port scan syn · port 9054 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9054 Chemin / cible — Payload �4��@�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �4��@�� Meta JSON brut { "bytes_in": 54, "payload_entropy": 3.705848099200768, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9054, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "2f4e07a59138df32e3fbb8195c3054bc42d757e7", "event_fingerprint": "0e748a364441305f623548cd87ecfbe60d61dc11", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d7b673fcc625b3fe0c577928300be63e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9054, "risk_score": 42 }, "payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "evidence": { "request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b24240df73f04fdb986ba1a5254fbc8e4f808253", "protocol_details": { "payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "port": 9054 }, "evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)", "target_port_label": "9054", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9054, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "port": 9054 }, "attack_vector": "port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd", "target_port_label": "9054", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9054" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.82, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
01/08/2026 09:03:53 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1efa91265313b060 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ZVUö�ڐȭ]��\|��7��(J�Y��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZVUö�ڐȭ]��\|��7��(J�Y��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZVUö�ڐȭ]��\|��7��(J�Y��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 351, "payload_entropy": 5.397304155385466, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "144b1e52aa86a58ec6c4d4cd06d7794a2ddc7c5a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1efa91265313b0607d774cf0cdfebe64", "payload_hash": "b821aa632782d0b9a3a07fc1ccbccbdb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003U\u00f6\ufffd\u0690\u0019\u022d]\ufffd\u000e\ufffd\|\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\u0007\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003U\u00f6\ufffd\u0690\u0019\u022d]\ufffd\u000e\ufffd\|\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\u0007\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003U\u00f6\ufffd\u0690\u0019\u022d]\ufffd\u000e\ufffd\|\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\u0007\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d039fbf9ed635b0d90ebc2815c4cc1c82ff58fb8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003U\u00f6\ufffd\u0690\u0019\u022d]\ufffd\u000e\ufffd\|\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\u0007\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "ZVU\u00f6\ufffd\u0690\u022d]\ufffd\ufffd\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003U\u00f6\ufffd\u0690\u0019\u022d]\ufffd\u000e\ufffd\|\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\u0007\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "ZVU\u00f6\ufffd\u0690\u022d]\ufffd\ufffd\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.8, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:53 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��Iri�� R�V��P�NE3��f��i<c�1uF� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Iri�� R�V��P�NE3��f��i<c�1uF� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��Iri�� R�V��P�NE3��f��i<c�1uF� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.867897414256075, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "67576e2e5639b025b861945e60b6b4ebeb68da22", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "payload_hash": "eb5aab628b87dc54f3556d4d7b8b6b21", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "ja3_client_category": "browser_like", "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002Iri\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1u\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002Iri\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1u\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002Iri\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1u\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a2614a342a7488bce5072b7515a89378e741c9fd", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002Iri\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1u\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdIri\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE3\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1uF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002Iri\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1u\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdIr*i\ufffd\ufffd\ufffd\tR\ufffdV\ufffd\ufffdP\ufffdNE3\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi<c\ufffd1uF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.6, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:53 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 67625c3bd21c0996 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload �� XV��X7@21��x2f�� F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��XV��X7@21��x2f�� F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) �� XV��X7@21��x2f�� F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "67625c3bd21c099689690498fb5b754e", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.777610162485902, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "d1e634537db6a515f9c0042999a3a84eb4b27fad", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "67625c3bd21c099689690498fb5b754e", "payload_hash": "4af1d18e0a3ba653cb1e1ee1497082f8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0301", "tls_cipher_count": 35, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\f\ufffd\u0018XV\ufffd\ufffdX\u001e7\u0002\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\u001b\t\u001c\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\f\ufffd\u0018XV\ufffd\ufffdX\u001e7\u0002\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\u001b\t\u001c\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\f\ufffd\u0018XV\ufffd\ufffdX\u001e7\u0002\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\u001b\t\u001c\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c471b77628cd5653e1a625011f48d666cb5cf01", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\f\ufffd\u0018XV\ufffd\ufffdX\u001e7\u0002\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\u001b\t\u001c\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdXV\ufffd\ufffdX7@21\ufffd\ufffdx2f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\f\ufffd\u0018XV\ufffd\ufffdX\u001e7\u0002\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\u001b\t\u001c\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdXV\ufffd\ufffdX7@21\ufffd\ufffdx2f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.6, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:52 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 329b5d847afc8165 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��jm�y�Hoۤ�Im:p��ܑe�&$�p�� H& ۻ�LmQ#��ߑ\|2)$�r��M�H= f 62.3.50.33 # 0 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��jm�y�Hoۤ�Im:p��ܑe�&$�p�� H& ۻ�LmQ#��ߑ\|2)$�r��M�H= f 62.3.50.33# 0 Requête brute (extrait) ��jm�y�Hoۤ�Im:p��ܑe�&$�p�� H& ۻ�LmQ#��ߑ\|2)$�r��M�H= f 62.3.50.33 # 0. �c�3�� ~��Q�0�<c�4��$��"�~�� e�0 Meta JSON brut { "tls_ja3_hash": "329b5d847afc81655969061add3bac67", "tls_sni": "62.3.50.33", "bytes_in": 1474, "payload_entropy": 7.748770210305192, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "69e949c993568d768a56525f0ff23516934c3048", "event_fingerprint": "1c674a2d94f17c94fd405b75588cfc294fb305db", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "329b5d847afc81655969061add3bac67", "payload_hash": "66ee02536b34ba35fa4cbde088a638ff", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 \ufffd~\ufffd\ufffd\ufffd\ufffdQ\ufffd0\ufffd\u0001<c\u001d\ufffd4\ufffd\u0004\ufffd\ufffd$\ufffd\u0012\ufffd\"\ufffd~\u0006\u0011\ufffd\u0004\ufffd\f\ufffde\ufffd0", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60cdd9cceaff961bb15d28d5ce0d2d77bfeda718", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "tls_ja3": "329b5d847afc81655969061add3bac67", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdjm\ufffdy\ufffdHo\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH& \u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\ufffdr\ufffd\ufffdM\ufffdH=\nf\r\n62.3.50.33#\r0", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "tls_ja3": "329b5d847afc81655969061add3bac67", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdjm\ufffdy\ufffdHo\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH& \u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1\|2)$\ufffdr\ufffd\ufffdM\ufffdH=\nf\r\n62.3.50.33#\r0", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip" ], "asn_dc_heuristic": true }
01/08/2026 09:03:52 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 de8c366fbb06bedc SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��a4'_߼,��EJ��2Q�zs��A��D�;m� � ��n8֚��^��{ O��s3H{ m 62.3.50.33 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��a4'_߼,��EJ��2Q�zs��A��D�;m� � ��n8֚��^��{ O��s3H{ m 62.3.50.33 � Requête brute (extrait) ��a4'_߼,��EJ��2Q�zs��A��D�;m� � ��n8֚��^��{ O��s3H{ m 62.3.50.33 �# ( +-3��~Ӑ��6��te��gXÝ�h��4��b Meta JSON brut { "tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "bytes_in": 1481, "payload_entropy": 7.696079416217483, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "69e949c993568d768a56525f0ff23516934c3048", "event_fingerprint": "42484e6fcde4b781b8c17f85f63e24dfe546394d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "de8c366fbb06bedcd7b86ddda1addac6", "payload_hash": "9084c839e056fc714eef049aecff2afc", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\u0014\ufffd;m\ufffd\u001b \ufffd\n\ufffd\ufffdn8\u059a\ufffd\u001d\ufffd\ufffd\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\u0011\ufffds3H\u0000{\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\u0014\ufffd;m\ufffd\u001b \ufffd\n\ufffd\ufffdn8\u059a\ufffd\u001d\ufffd\ufffd\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\u0011\ufffds3H\u0000{\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0014~\u04d0\ufffd\ufffd\u00036\ufffd\ufffdte\ufffd\ufffd\u001a\ufffdgX\u00dd\ufffdh\ufffd\ufffd\u0001\ufffd\ufffd4\u000e\ufffd\ufffd\ufffdb", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\u0014\ufffd;m\ufffd\u001b \ufffd\n\ufffd\ufffdn8\u059a\ufffd\u001d\ufffd\ufffd\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\u0011\ufffds3H\u0000{\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3fc355e48bacd58fc9483f56e5e30514a1500499", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\u0014\ufffd;m\ufffd\u001b \ufffd\n\ufffd\ufffdn8\u059a\ufffd\u001d\ufffd\ufffd\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\u0011\ufffds3H\u0000{\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\ufffd;m\ufffd \ufffd\n\ufffd\ufffdn8\u059a\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\ufffds3H{\nm\r\n62.3.50.33\n\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\u0014\ufffd;m\ufffd\u001b \ufffd\n\ufffd\ufffdn8\u059a\ufffd\u001d\ufffd\ufffd\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\u0011\ufffds3H\u0000{\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffda4'_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\ufffd;m\ufffd \ufffd\n\ufffd\ufffdn8\u059a\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd{\rO\ufffd\ufffd\ufffd\ufffds3H{\nm\r\n62.3.50.33\n\ufffd", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip" ], "asn_dc_heuristic": true }
01/08/2026 09:03:52 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 3947c3d16bc8cd21 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��w1}�Fk��jR) !� I��`ējWRm ��y ��RU�ܱ��,�)�ʥ��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello User-Agent — Règles WAF — Payload (extrait) ��w1}�Fk��jR) !� I��`ējWRm ��y��RU�ܱ��,�)�ʥ��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��w1}�Fk��jR) !� I��`ējWRm ��y ��RU�ܱ��,�)�ʥ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5 Meta JSON brut { "tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 1695, "payload_entropy": 7.612865648814103, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "e3b02a9b5814ca599024b420fa82901ef2cdb53d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello" ], "pattern_ids": [ "pat-0554", "pat-0578" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "payload_hash": "e1f5fa19b34e575d3f3a4f5f0a29d090", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\u001b)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\u0001\ufffd\u0004y\f\u001f\ufffd\ufffdRU\ufffd\u0017\u001f\u0731\ufffd\ufffd\u0019\ufffd\ufffd\ufffd,\u0004\ufffd)\ufffd\u02a5\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\u001b)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\u0001\ufffd\u0004y\f\u001f\ufffd\ufffdRU\ufffd\u0017\u001f\u0731\ufffd\ufffd\u0019\ufffd\ufffd\ufffd,\u0004\ufffd)\ufffd\u02a5\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\u001b)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\u0001\ufffd\u0004y\f\u001f\ufffd\ufffdRU\ufffd\u0017\u001f\u0731\ufffd\ufffd\u0019\ufffd\ufffd\ufffd,\u0004\ufffd)\ufffd\u02a5\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "221e07a16e4b83615c9713bd2624a7b2d67ef97b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\u001b)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\u0001\ufffd\u0004y\f\u001f\ufffd\ufffdRU\ufffd\u0017\u001f\u0731\ufffd\ufffd\u0019\ufffd\ufffd\ufffd,\u0004\ufffd)\ufffd\u02a5\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\ufffdy\ufffd\ufffdRU\ufffd\u0731\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd)\ufffd\u02a5\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\u001b)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\u0001\ufffd\u0004y\f\u001f\ufffd\ufffdRU\ufffd\u0017\u001f\u0731\ufffd\ufffd\u0019\ufffd\ufffd\ufffd,\u0004\ufffd)\ufffd\u02a5\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR)\n!\ufffd\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\ufffdy\ufffd\ufffdRU\ufffd\u0731\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd)\ufffd\u02a5\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:51 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 67625c3bd21c0996 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��Caٕ�E��<.Y�Cl��s�&׬4�}��F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Caٕ�E��<.Y�Cl��s�&׬4�}��F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��Caٕ�E��<.Y�Cl��s�&׬4�}��F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "67625c3bd21c099689690498fb5b754e", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.859122519665847, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "91a95626ec19781aa1f909652fbb4d3dde4a59ab", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "67625c3bd21c099689690498fb5b754e", "payload_hash": "792ab810948dbb62220af88a1490fda9", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0301", "tls_cipher_count": 35, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdCa\u0655\ufffd\u001eE\ufffd\u0014\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\u001c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdCa\u0655\ufffd\u001eE\ufffd\u0014\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\u001c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdCa\u0655\ufffd\u001eE\ufffd\u0014\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\u001c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "669226b80b1672fd9ef54fea56e25fe0d37affde", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdCa\u0655\ufffd\u001eE\ufffd\u0014\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\u001c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdCa\u0655\ufffdE\ufffd\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdCa\u0655\ufffd\u001eE\ufffd\u0014\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\u001c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdCa\u0655\ufffdE\ufffd\ufffd<.Y\ufffdCl\ufffd\ufffds\ufffd&\u05ec4\ufffd}\ufffd\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.8, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:51 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��0V~>��H�R#��p��J�m��H��F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��0V~>��H�R#��p��J�m��H��F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��0V~>��H�R#��p��J�m��H��F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.835694716979506, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "67576e2e5639b025b861945e60b6b4ebeb68da22", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "payload_hash": "7dc1cf30846d39d9e3e247435feeb925", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "ja3_client_category": "browser_like", "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00020V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\u0003\ufffd\ufffd\ufffdJ\ufffd\u0016m\ufffd\ufffdH\ufffd\ufffd\u001e\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00020V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\u0003\ufffd\ufffd\ufffdJ\ufffd\u0016m\ufffd\ufffdH\ufffd\ufffd\u001e\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00020V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\u0003\ufffd\ufffd\ufffdJ\ufffd\u0016m\ufffd\ufffdH\ufffd\ufffd\u001e\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "80ead6bd1247640013b85b969b977e132365d492", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00020V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\u0003\ufffd\ufffd\ufffdJ\ufffd\u0016m\ufffd\ufffdH\ufffd\ufffd\u001e\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd0V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdJ\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00020V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\u0003\ufffd\ufffd\ufffdJ\ufffd\u0016m\ufffd\ufffdH\ufffd\ufffd\u001e\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd0V~>\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdJ\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:51 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 4ae33de1ad939562 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�x��Hoۣ�Im9p��ܑd�&$�p�� H%!ۺ�LmP$��ߑ{3)$�r��N�H<� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�x��Hoۣ�Im9p��ܑd�&$�p�� H%!ۺ�LmP$��ߑ{3)$�r��N�H<� Requête brute (extrait) ~zjm�x��Hoۣ�Im9p��ܑd�&$�p�� H%!ۺ�LmP$��ߑ{3)$�r��N�H<� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.73852240793123, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "9c33a4e0d4fc455056cfdc91bf0b498dec73c162", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "4ae33de1ad93956213297c61748ec996", "payload_hash": "2acb1107aa098f05f19e3cb823f35c36", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b4087337350a0b6020096e1e7e00896eef3099f", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.82, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:51 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1efa91265313b060 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ZV��{_��\$l��0��o�"��Xc&}o!�`��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZV��{_��\$l��0��o�"��Xc&}o!�`��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZV��{_��\$l��0��o�"��Xc&}o!�`��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 351, "payload_entropy": 5.359284275134907, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "144b1e52aa86a58ec6c4d4cd06d7794a2ddc7c5a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1efa91265313b0607d774cf0cdfebe64", "payload_hash": "255eec531ee278b85836fca3a8ea94d2", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd\u00050\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&\u0016}o!\ufffd\u001d`\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd\u00050\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&\u0016}o!\ufffd\u001d`\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd\u00050\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&\u0016}o!\ufffd\u001d`\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3a4378c9cbec67d6d3700b8ca131b7fe2e815871", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd\u00050\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&\u0016}o!\ufffd\u001d`\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "ZV\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd0\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&}o!\ufffd`\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd\u00050\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&\u0016}o!\ufffd\u001d`\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "ZV\ufffd\ufffd{_\ufffd\ufffd\\$l\ufffd\ufffd\ufffd0\ufffd\ufffdo\ufffd\"\ufffd\ufffdXc&}o!*\ufffd`\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.8, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 3947c3d16bc8cd21 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��8ۓ7�_�E�U_RrG�$=��;m�q\�-~ �V�\�L�\��>]"uXu�f��%��q�!F��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello User-Agent — Règles WAF — Payload (extrait) ��8ۓ7�_�E�U_RrG�$=��;m�q\�-~ �V�\�L�\��>]"uXu�f��%��q�!F��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��8ۓ7�_�E�U_RrG�$=��;m�q\�-~ �V�\�L�\��>]"uXu�f��%��q�!F��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5 Meta JSON brut { "tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 1695, "payload_entropy": 7.601669455507244, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "b33cbf940974eac6cadced1a696156d8de8b11dd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello" ], "pattern_ids": [ "pat-0554", "pat-0578" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "payload_hash": "5ceeef7ce938ddafd4c60390d1e6e659", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd8\u06d37\ufffd\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-\u0007~\b \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\u0011\"uXu\u0019\ufffd\u0012f\ufffd\ufffd%\ufffd\ufffdq\u0013\ufffd!F\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd8\u06d37\ufffd\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-\u0007~\b \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\u0011\"uXu\u0019\ufffd\u0012f\ufffd\ufffd%\ufffd\ufffdq\u0013\ufffd!F\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd8\u06d37\ufffd\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-\u0007~\b \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\u0011\"uXu\u0019\ufffd\u0012f\ufffd\ufffd%\ufffd\ufffdq\u0013\ufffd!F\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "667c4b3fab34e44792f5450182e720b10b9927a2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd8\u06d37\ufffd\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-\u0007~\b \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\u0011\"uXu\u0019\ufffd\u0012f\ufffd\ufffd%\ufffd\ufffdq\u0013\ufffd!F\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd8\u06d37\ufffd_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-~ \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\"uXu\ufffdf\ufffd\ufffd%\ufffd\ufffdq\ufffd!F\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd8\u06d37\ufffd\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-\u0007~\b \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\u0011\"uXu\u0019\ufffd\u0012f\ufffd\ufffd%\ufffd\ufffdq\u0013\ufffd!F\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd8\u06d37\ufffd_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\ufffd-~ \ufffdV\ufffd\\\ufffdL\ufffd\\\ufffd\ufffd>]\"uXu\ufffdf\ufffd\ufffd%\ufffd\ufffdq\ufffd!F\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.92, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) Payload ZV�EkR�O��o��7�c΄�b{��_��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZV�EkR�O��o��7�c΄�b{��_��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZV�EkR�O��o��7�c΄�b{��_��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 351, "payload_entropy": 5.395437995749987, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "09550c21828c7db54d9eff7cb87fbc1a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\u0004b{\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\u0012\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\u0004b{\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\u0012\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\u0004b{\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\u0012\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "deaa9bab40c2f27e31ca0e4164185e225de7a2d0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\u0004b{\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\u0012\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "ZV\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffdb{\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\u0004b{\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\u0012\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "ZV\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffdb{\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.9, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 e53406bbb3118b0c SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�w��H �ۢJm8�� ݑc�&$�#p�� H$:۹�LmOU��ߑzd)$�r��g�H;� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�w��H �ۢJm8�� ݑc�&$�#p�� H$:۹�LmOU��ߑzd)$�r��g�H;� Requête brute (extrait) ~zjm�w��H �ۢJm8�� ݑc�&$�#p�� H$:۹�LmOU��ߑzd)$�r��g�H;� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "e53406bbb3118b0c8a662f6717ac159d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.743432840089055, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "fd753490a1d14fe156f7d8f8abe86003f4182787", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "e53406bbb3118b0c8a662f6717ac159d", "payload_hash": "375bc25b4e3fa3e807d5e897a8e763fb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c7cfe290a730dcb9f53c9da5dec8c8183dadefef", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "e53406bbb3118b0c8a662f6717ac159d", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffdw\ufffd\ufffdH\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "e53406bbb3118b0c8a662f6717ac159d", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffdw\ufffd\ufffdH\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\ufffd", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.89, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1efa91265313b060 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ZVAeW� �ᕓ��宒�߾�� ߴ}�\;��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZVAeW��ᕓ��宒�߾�� ߴ}�\;��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZVAeW� �ᕓ��宒�߾�� ߴ}�\;��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 351, "payload_entropy": 5.344307350929435, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "6ec0006ee2b31618365dde5e5ec166698152a891", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1efa91265313b0607d774cf0cdfebe64", "payload_hash": "3a51d434d8ef8f3cf792f32d00dd5bc7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003AeW\ufffd\f\ufffd\u001a\u1553\ufffd\ufffd\u5b92\ufffd\u0002\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003AeW\ufffd\f\ufffd\u001a\u1553\ufffd\ufffd\u5b92\ufffd\u0002\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003AeW\ufffd\f\ufffd\u001a\u1553\ufffd\ufffd\u5b92\ufffd\u0002\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5db46977a01a56abe760d65c32b7d8fd9b606eae", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003AeW\ufffd\f\ufffd\u001a\u1553\ufffd\ufffd\u5b92\ufffd\u0002\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "ZVAeW\ufffd\ufffd\u1553\ufffd\ufffd\u5b92\ufffd\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003AeW\ufffd\f\ufffd\u001a\u1553\ufffd\ufffd\u5b92\ufffd\u0002\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "ZVAeW\ufffd\ufffd\u1553\ufffd\ufffd\u5b92\ufffd\u07fe\ufffd\ufffd\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\;\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.85, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) SNI TLS 62.3.50.33 Payload ��n�\��p��C˿.+��{H�h8:�rͯ&�F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��n�\��p��C˿.+��{H�h8:�rͯ&�F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��n�\��p��C˿.+��{H�h8:�rͯ&�F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 175, "payload_entropy": 4.881409002693791, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "852c1ba041d875bcffb5df08db59119d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like", "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002n\ufffd\u0005\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\u0003\u036f&\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002n\ufffd\u0005\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\u0003\u036f&\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002n\ufffd\u0005\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\u0003\u036f&\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7c797c491054232a37c9d584fa6e90abf4e3e2c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002n\ufffd\u0005\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\u0003\u036f&\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "\ufffd\ufffdn\ufffd\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\ufffd\ufffd{H\ufffdh8:\ufffdr\u036f&\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002n\ufffd\u0005\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\u0003\u036f&\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdn\ufffd*\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\ufffd\ufffd{H\ufffdh8:\ufffdr\u036f&\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.84, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 67625c3bd21c0996 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload �� HnC��X#?��脄wj8��KB��TdF� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �� HnC��X#?��脄wj8��KB��TdF� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) �� HnC��X#?��脄wj8��KB��TdF� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "67625c3bd21c099689690498fb5b754e", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.843278918657326, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "d1e634537db6a515f9c0042999a3a84eb4b27fad", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "67625c3bd21c099689690498fb5b754e", "payload_hash": "98ecd66ab7421ed84de333d84c538043", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0301", "tls_cipher_count": 35, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\u0000d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\u0000d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\u0000d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "809578196aba48b9c2f4a1418f93ca3f5e71a198", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\u0000d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdTdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\u0000d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdTdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.84, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��D7�d3��g��P(I�Y{��hN'#{�GF� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��D7�d3��g��P(I�Y{��hN'#{�GF� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��D7�d3��g��P(I�Y{��hN'#{�GF� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.852155199957998, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "db826933ae27a2eb10e83c34641a7b84f3456ff4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "payload_hash": "41b2e9fd70bf72242c9751c91dd01498", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "ja3_client_category": "browser_like", "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\u0003{\ufffd\ufffdhN'\u0013#{\ufffdG\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\u0003{\ufffd\ufffdhN'\u0013#{\ufffdG\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\u0003{\ufffd\ufffdhN'\u0013#{\ufffdG\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "631edf702811a2ef9760dc9cfe71c18a2191f301", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\u0003{\ufffd\ufffdhN'\u0013#{\ufffdG\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY{\ufffd\ufffdhN'#{\ufffdGF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\u0003{\ufffd\ufffdhN'\u0013#{\ufffdG\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY{\ufffd\ufffdhN'#{\ufffdGF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.8, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 67625c3bd21c0996 SNI 62.3.50.33 Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) SNI TLS 62.3.50.33 Payload ��E�4�p�7'��uo Z��H�U�F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��E�4�p�7'��uo Z��H�U�F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��E�4�p�7'��uo Z��H�U�F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 175, "payload_entropy": 4.884780948212551, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "78a3f7d7c7b2ccb2051c79e4dd5c8f0a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "67625c3bd21c099689690498fb5b754e", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "67625c3bd21c099689690498fb5b754e", "tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0301", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u0013\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\u0012\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u0013\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\u0012\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u0013\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\u0012\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "65cd18f07a4adfe481c36f0a94be57666d6aea3f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u0013\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\u0012\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u0013\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\u0012\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "67625c3bd21c099689690498fb5b754e", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd4\ufffdp\ufffd7'\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:50 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1196e3b1fa255a44 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�x��Hoۣ�Im9p��ܑd�&$�p�� H%!ۺ�LmP$��ߑ{3)$�r��N�H<� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�x��Hoۣ�Im9p��ܑd�&$�p�� H%!ۺ�LmP$��ߑ{3)$�r��N�H<� Requête brute (extrait) ~zjm�x��Hoۣ�Im9p��ܑd�&$�p�� H%!ۺ�LmP$��ߑ{3)$�r��N�H<� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "1196e3b1fa255a444a88617c122e45a5", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.739239353154586, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "276e969e3ee858facd54d296ed8db7f7302ac426", "event_fingerprint": "56a07a54588daae8b9ef983f8d0b11a33d8d1060", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1196e3b1fa255a444a88617c122e45a5", "payload_hash": "58fbda8fc08e90de27fd8010e50787d8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "66c22316db4eff5bcd942c854b4b630d5f7ea215", "protocol_details": { "payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "1196e3b1fa255a444a88617c122e45a5", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "1196e3b1fa255a444a88617c122e45a5", "tls_sni": "62.3.50.33", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) Payload �� ?8˝8��_7C3B� 4��S��`�� 0�h,� � �<��,.�m�S�d �V�V� A��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello User-Agent — Règles WAF — Payload (extrait) ��?8˝8��_7C3B� 4��S��`�� 0�h,� ��<��,.�m�S�d�V�V�A��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) �� ?8˝8��_7C3B� 4��S��`�� 0�h,� � �<��,.�m�S�d �V�V� A��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 1695, "payload_entropy": 7.604625875698278, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello" ], "pattern_ids": [ "pat-0554", "pat-0578" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "003bbf442342091b989868562c67d52c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\u0005?8\u02dd8\ufffd\ufffd\ufffd_\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\u0016\ufffd 0\u000e\ufffdh,\ufffd\n\ufffd\f\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\u0019d\f\ufffdV\ufffdV\ufffd\fA\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\u0005?8\u02dd8\ufffd\ufffd\ufffd_\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\u0016\ufffd 0\u000e\ufffdh,\ufffd\n\ufffd\f\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\u0019d\f\ufffdV\ufffdV\ufffd\fA\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\u0005?8\u02dd8\ufffd\ufffd\ufffd_\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\u0016\ufffd 0\u000e\ufffdh,\ufffd\n\ufffd\f\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\u0019d\f\ufffdV\ufffdV\ufffd\fA\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cf8177a3d3e00465325590a5d5b2fa9c42dc3bf0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\u0005?8\u02dd8\ufffd\ufffd\ufffd_\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\u0016\ufffd 0\u000e\ufffdh,\ufffd\n\ufffd\f\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\u0019d\f\ufffdV\ufffdV\ufffd\fA\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd?8\u02dd8\ufffd\ufffd\ufffd_7C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\ufffd 0\ufffdh,\ufffd\n\ufffd\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffdd\ufffdV\ufffdV\ufffdA\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\u0005?8\u02dd8\ufffd\ufffd\ufffd_\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\u0016\ufffd 0\u000e\ufffdh,\ufffd\n\ufffd\f\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\u0019d\f\ufffdV\ufffdV\ufffd\fA\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd?8\u02dd8\ufffd\ufffd\ufffd_7C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\ufffd 0\ufffdh,\ufffd\n\ufffd\ufffd<\ufffd\ufffd,.\ufffdm\ufffdS\ufffdd\ufffdV\ufffdV\ufffdA\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.82, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	9043 · TLS	tls	Scan de ports port scan syn · via TLS:9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Service TLS Payload �� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) �� Meta JSON brut { "tls_ja3_hash": null, "tls_sni": null, "bytes_in": 11, "payload_entropy": 2.2221915755066783, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 23, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 23, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "58083672fa93c640310389ca8fbad9ab1e6c61a9", "event_fingerprint": "057b6ddf4aa87067adeb21d1234e9cefcd1e4f2f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 23, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "55b6c6b63391f7a244877208a3a6144c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9043, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "evidence": { "request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6d9a852ccaff39d1166d666a1e45e663fe1cfa4a", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 23, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000", "port": 9043, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd", "target_port_label": "9043 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.82, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_no_sni" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 1efa91265313b060 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ZV�\��a2'$;�� nb�EgYLX�?a��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZV�\��a2'$;��nb�EgYLX�?a��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZV�\��a2'$;�� nb�EgYLX�?a��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 32, "bytes_in": 351, "payload_entropy": 5.3395700741703935, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "6ec0006ee2b31618365dde5e5ec166698152a891", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "1efa91265313b0607d774cf0cdfebe64", "payload_hash": "7c719d704df4ce6c0381bb3e0c775fd1", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\u000b\ufffd\ufffd\u0010nb\ufffd\u001d\u0018Eg\u001c\u001cYLX\ufffd?a\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\u000b\ufffd\ufffd\u0010nb\ufffd\u001d\u0018Eg\u001c\u001cYLX\ufffd?a\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\u000b\ufffd\ufffd\u0010nb\ufffd\u001d\u0018Eg\u001c\u001cYLX\ufffd?a\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ac2d5d7f09e248deb5ed4d95ff9bd21bde765ad", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\u000b\ufffd\ufffd\u0010nb\ufffd\u001d\u0018Eg\u001c\u001cYLX\ufffd?a\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "ZV\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\ufffd\ufffdnb\ufffdEgYLX\ufffd?a\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\u000b\ufffd\ufffd\u0010nb\ufffd\u001d\u0018Eg\u001c\u001cYLX\ufffd?a\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "tls_ja3": "1efa91265313b0607d774cf0cdfebe64", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "ZV\ufffd\\\ufffd\ufffda2'$;\ufffd\ufffd\ufffd\ufffdnb\ufffdEgYLX\ufffd?a\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.62, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) Payload ��jm�v��H �ۡJm7��!ݑb�&$�$p�� H#;۸�LmNV��ߑye)$�r��h�H: f 62.3.50.33 # 0 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��jm�v��H�ۡJm7��!ݑb�&$�$p�� H#;۸�LmNV��ߑye)$�r��h�H: f 62.3.50.33# 0 Requête brute (extrait) ��jm�v��H �ۡJm7��!ݑb�&$�$p�� H#;۸�LmNV��ߑye)$�r��h�H: f 62.3.50.33 # 0. �c�3�� NB�0)�s�U�cO��T�n>��L�3?t5��$�× Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 1474, "payload_entropy": 7.737164685636475, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c880e28748501c9c1eb02d767b1eb59a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 \ufffd\ufffdNB\ufffd0)\ufffds\ufffdU\ufffdcO\ufffd\ufffd\u0013\ufffdT\ufffdn>\ufffd\ufffd\ufffdL\ufffd3?t5\u0011\ufffd\u0004\ufffd\ufffd$\ufffd\u00d7", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "820e25c97ebdc2c3ecb1af785fe94b6b9e068410", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\nf\r\n62.3.50.33#\r0", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\nf\r\n62.3.50.33#\r0", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.6, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	9043	—	Scan de ports port scan syn · port 9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "1967e2ac78c4d195e7bb531768614cff63779fa2", "event_fingerprint": "a5d960ec4504b5b264e69a508b26c9d11ef8f308", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9043, "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fce046332eaff7a2d488ed32d7c21b21877593b7", "protocol_details": { "port": 9043 }, "attack_vector": "port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)", "target_port_label": "9043", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9043 }, "attack_vector": "port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9043", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.9, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 959770bcbec3f21e SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��jm�v��H �ۡJm7��!ݑb�&$�$p�� H#;۸�LmNV��ߑye)$�r��h�H: f 62.3.50.33 # 0 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��jm�v��H�ۡJm7��!ݑb�&$�$p�� H#;۸�LmNV��ߑye)$�r��h�H: f 62.3.50.33# 0 Requête brute (extrait) ��jm�v��H �ۡJm7��!ݑb�&$�$p�� H#;۸�LmNV��ߑye)$�r��h�H: f 62.3.50.33 # 0. �c�3�� ؓ��6\|ğ�v��5�YLЇ�x4��JM}"R��]?1 Meta JSON brut { "tls_ja3_hash": "959770bcbec3f21ef183c822429f3d47", "tls_sni": "62.3.50.33", "bytes_in": 1474, "payload_entropy": 7.71369176153976, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1c194275f715ceeb291b1cb8ebcfceaaba595331", "event_fingerprint": "c097051014870d7fe0bfb54777832d20679cada3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "959770bcbec3f21ef183c822429f3d47", "payload_hash": "52e6f32a0610afb9ce3a3e0360089fa8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 \ufffd\ufffd\u0613\ufffd\ufffd6\|\u011f\ufffdv\ufffd\ufffd5\ufffd\u0002YL\u0407\ufffdx4\ufffd\ufffdJM}\"R\u0011\ufffd\u0004\ufffd\ufffd\ufffd]?1", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9a7ba45f800793f38cc9c6a4f80ed40dca28be5d", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "tls_ja3": "959770bcbec3f21ef183c822429f3d47", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\nf\r\n62.3.50.33#\r0", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000", "tls_ja3": "959770bcbec3f21ef183c822429f3d47", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\nf\r\n62.3.50.33#\r0", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.89, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) Payload ��nx�(��&�r�L��Q��`��a� U�?�ϑ�Y��A�eC]��>V5%V m 62.3.50.33 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��nx�(��&�r�L��Q��`��a� U�?�ϑ�Y��A�eC]��>V5%V m 62.3.50.33 � Requête brute (extrait) ��nx�(��&�r�L��Q��`��a� U�?�ϑ�Y��A�eC]��>V5%V m 62.3.50.33 �# ( +-3��lp.2c�[E��kW�6d�5�l ��v6W�Hw{;?� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 1481, "payload_entropy": 7.7355077848305775, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7c6fa5c8e9266286bf8fbb872cbbef86", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\u0019 U\ufffd?\u001f\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>V5%V\u0013\u0014\t\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\u0019 U\ufffd?\u001f\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>V5%V\u0013\u0014\t\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0013lp.2c\ufffd[E\u0013\ufffd\ufffdkW\ufffd6d\ufffd5\ufffdl\r\ufffd\ufffdv6W\ufffdHw{;?\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\u0019 U\ufffd?\u001f\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>V5%V\u0013\u0014\t\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "98156049f78bee1b63280dbd023989b108583d44", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\u0019 U\ufffd?\u001f\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>V5%V\u0013\u0014\t\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "\ufffd\ufffd\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd U\ufffd?\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\ufffd\ufffd\ufffd>V5%V\t\nm\r\n62.3.50.33\n\ufffd", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\u0019 U\ufffd?\u001f\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\u0013\ufffd\ufffd\ufffd>V5%V\u0013\u0014\t\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdnx\ufffd(\ufffd\ufffd&\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd U\ufffd?\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\ufffd\ufffd\ufffd>V5%V\t\nm\r\n62.3.50.33\n\ufffd", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.87, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	9043	—	Scan de ports port scan syn · port 9043 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9043 Chemin / cible — Payload �4��@�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �4��@�� Meta JSON brut { "bytes_in": 54, "payload_entropy": 3.705848099200768, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9043, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "1967e2ac78c4d195e7bb531768614cff63779fa2", "event_fingerprint": "a5d960ec4504b5b264e69a508b26c9d11ef8f308", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d7b673fcc625b3fe0c577928300be63e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9043, "risk_score": 42 }, "payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "evidence": { "request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b516fb4d327527ab82ca7d4594bc18731a3cd8f4", "protocol_details": { "payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "port": 9043 }, "evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)", "target_port_label": "9043", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9043, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f", "port": 9043 }, "attack_vector": "port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd", "target_port_label": "9043", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9043" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.86, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
01/08/2026 09:03:49 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 de8c366fbb06bedc SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��q��R=Q�¼�g�v��/6�4��C�0� � y�q��6 h) ��?��\|��]�� m 62.3.50.33 � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��q��R=Q�¼�g�v��/6�4��C�0� � y�q��6 h)��?��\|��]�� m 62.3.50.33 � Requête brute (extrait) ��q��R=Q�¼�g�v��/6�4��C�0� � y�q��6 h) ��?��\|��]�� m 62.3.50.33 �# ( +-3��6��r�6�a��l��cCux��j=�3 Meta JSON brut { "tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "bytes_in": 1481, "payload_entropy": 7.730113668502134, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1c194275f715ceeb291b1cb8ebcfceaaba595331", "event_fingerprint": "5921b6d7173732f1fba4c8e4cca0d7c104024d57", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "de8c366fbb06bedcd7b86ddda1addac6", "payload_hash": "2fcd15eedee1419ba850c995dd0ac583", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\f\ufffd\u0002\u0000\ufffd?\ufffd\ufffd\u0018\|\ufffd\ufffd\ufffd\u001a\ufffd]\u001d\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\f\ufffd\u0002\u0000\ufffd?\ufffd\ufffd\u0018\|\ufffd\ufffd\ufffd\u001a\ufffd]\u001d\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd6\u000e\ufffd\ufffdr\ufffd6\ufffda\u001a\ufffd\ufffd\u0004l\ufffd\ufffdcCux\ufffd\ufffd\u0019\ufffd\u0015\ufffd\ufffdj\u0019=\u0016\ufffd3", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\f\ufffd\u0002\u0000\ufffd?\ufffd\ufffd\u0018\|\ufffd\ufffd\ufffd\u001a\ufffd]\u001d\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4869c7d836113e5d9ef43a0bbbb4c971fd68fc67", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\f\ufffd\u0002\u0000\ufffd?\ufffd\ufffd\u0018\|\ufffd\ufffd\ufffd\u001a\ufffd]\u001d\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\ufffd\ufffd?\ufffd\ufffd\|\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\nm\r\n62.3.50.33\n\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\f\ufffd\u0002\u0000\ufffd?\ufffd\ufffd\u0018\|\ufffd\ufffd\ufffd\u001a\ufffd]\u001d\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000", "tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffdC\ufffd0\ufffd \ufffd\ry\ufffdq\ufffd\ufffd6\th)\ufffd\ufffd?\ufffd\ufffd\|\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\nm\r\n62.3.50.33\n\ufffd", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.83, "multi_protocol_correlation": true, "multi_protocol_count": 46, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip" ], "asn_dc_heuristic": true }
01/08/2026 09:03:48 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) SNI TLS 62.3.50.33 Payload ��;��}t$<�oܺ,5�l�(X��F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��;��}t$<�oܺ,5�l�(X��F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��;��}t$<�oܺ,5�l�(X��F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 175, "payload_entropy": 4.861251758815763, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "50e2fffb2f39899f91a4b5083b0251f8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like", "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\u0000\ufffd(X\ufffd\u001b\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\u0000\ufffd(X\ufffd\u001b\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\u0000\ufffd(X\ufffd\u001b\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46761935e73573c5157fb0650a62e3faa5cc6879", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\u0000\ufffd(X\ufffd\u001b\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\ufffd(X\ufffd\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\u0000\ufffd(X\ufffd\u001b\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$<\ufffdo\u073a,5\ufffdl\ufffd(X\ufffd\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.67, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:48 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /v1/swagger.json	Élevée	Élevé · 65
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /v1/swagger.json UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950316:lfi-14 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /v1/swagger.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /v1/swagger.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Élevé · 65 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET /v1/swagger.json HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36 Règles WAF lfi-14 rce-0 nosqli-3 Payload (extrait) GET /v1/swagger.json HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880 Accept: / User-Agent: Mozilla/5.0 (X11; Requête brute (extrait) GET /v1/swagger.json HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880 Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30", "emulator_response_len": 222, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "e94391cc8fe1320169499d4960096ce95e356a37", "http_host_hash": "c3a8697c6c279a95f0caf2b5f47944b1de8a6733", "http_target_hash": "7627fa107933323bf661cade27cead0da21efcde", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 219, "payload_entropy": 5.480135730688123, "port_category": "registered", "org": "Google LLC", "service": "http", "app_proto": "http", "asn": 396982, "country": "US", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 6, "anomaly_count": 0, "campaign_key": "a7c367cf3eb99fe4c81124788d072f3024ca5a82", "event_fingerprint": "e5370e137e9a3e9bd5d018b3220e276f63f58360", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6bd514d731f202b33c4f6bd8919738b7", "payload_hash": "00280f465dba4a63a1e2ae5b9cce7f11", "path_pattern_hash": "f86aafc3677c18150142bcf664f5a6ed" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11; ", "method": "GET", "path": "\/v1\/swagger.json", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-14", "rce-0", "nosqli-3" ], "request_line": "GET \/v1\/swagger.json HTTP\/1.1", "request_sample": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11;", "evidence": { "method": "GET", "path": "\/v1\/swagger.json", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36", "waf_tags": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-14", "rce-0", "nosqli-3" ], "request_line": "GET \/v1\/swagger.json HTTP\/1.1", "request_sample": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11;", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "aed6751ee17d2063e438249c3dad07607299b43b", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/swagger.json", "request_line": "GET \/v1\/swagger.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11;", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/swagger.json", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/swagger.json", "request_line": "GET \/v1\/swagger.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/swagger.json", "evidence_snippet": "GET \/v1\/swagger.json HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: \/\r\nUser-Agent: Mozilla\/5.0 (X11;", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +28 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.66, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_swagger_probe", "net_port_scan_slow" ], "asn_dc_heuristic": true }
01/08/2026 09:03:48 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��u�SF 4�(�ZXΩ��p��!\|��F� �98��:�� 32ED�4F��5�/A ��7 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��u�SF4�(�ZXΩ��p��!\|��F� �98��:�� 32ED�4F��5�/A ��7 Requête brute (extrait) ��u�SF 4�(�ZXΩ��p��!\|��F� �98��:�� 32ED�4F��5�/A ��7 62.3.50.33 # Meta JSON brut { "tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 23, "bytes_in": 175, "payload_entropy": 4.865666788395714, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "db826933ae27a2eb10e83c34641a7b84f3456ff4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "payload_hash": "5b44ae70e83d07768a8dd407b7d97513", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "62d31e78fdc457d27559991ebb0871be", "tls_version": "0x0302", "tls_cipher_count": 35, "tls_sni": "62.3.50.33", "ja3_client_category": "browser_like" }, "tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be", "tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203", "tls_version": "0x0302", "tls_cipher_count": 35, "ja3_client_category": "browser_like", "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\f4\ufffd(\ufffdZ\u0002X\u03a9\ufffd\u001b\ufffdp\ufffd\ufffd\u0003!\|\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\f4\ufffd(\ufffdZ\u0002X\u03a9\ufffd\u001b\ufffdp\ufffd\ufffd\u0003!\|\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\f4\ufffd(\ufffdZ\u0002X\u03a9\ufffd\u001b\ufffdp\ufffd\ufffd\u0003!\|\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "005b26ed9daf9734672e0273ef8266c90153647f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\f4\ufffd(\ufffdZ\u0002X\u03a9\ufffd\u001b\ufffdp\ufffd\ufffd\u0003!\|\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF4\ufffd(\ufffdZX\u03a9\ufffd\ufffdp\ufffd\ufffd!\|\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\f4\ufffd(\ufffdZ\u0002X\u03a9\ufffd\u001b\ufffdp\ufffd\ufffd\u0003!\|\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000", "tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48", "tls_ja4": "62d31e78fdc457d27559991ebb0871be", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF4\ufffd(\ufffdZX\u03a9\ufffd\ufffdp\ufffd\ufffd!\|\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.64, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:48 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) Payload ~zjm�u��H �۠Jm6��"ݑa�&$�%p�� H"<۷�LmMW��ߑxf)$�r��i�H9� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�u��H�۠Jm6��"ݑa�&$�%p�� H"<۷�LmMW��ߑxf)$�r��i�H9� Requête brute (extrait) ~zjm�u��H �۠Jm6��"ݑa�&$�%p�� H"<۷�LmMW��ߑxf)$�r��i�H9� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 899, "payload_entropy": 5.743058781718342, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2c216d6615c900b053ae4d57d1d4ad0a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a985fa29a8dc510ab8384e743798b45f15f45ec", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.62, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }
01/08/2026 09:03:48 UTC	TCP	8764 · TLS	tls	Scan de ports port scan syn · via TLS:8764 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 4ae33de1ad939562 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 8764 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ~zjm�u��H �۠Jm6��"ݑa�&$�%p�� H"<۷�LmMW��ߑxf)$�r��i�H9� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ~zjm�u��H�۠Jm6��"ݑa�&$�%p�� H"<۷�LmMW��ߑxf)$�r��i�H9� Requête brute (extrait) ~zjm�u��H �۠Jm6��"ݑa�&$�%p�� H"<۷�LmMW��ߑxf)$�r��i�H9� !"#$%&'()+,-./0123456789:;<=>?@ABCDEFghijklm�� Meta JSON brut { "tls_ja3_hash": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 102, "bytes_in": 899, "payload_entropy": 5.743058781718342, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 8764, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5fcedec66145ae3b327dad80fd3d18700aaf46ca", "event_fingerprint": "d0fa2f3f0b339111a6c4b4b81018509aebb179b5", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "4ae33de1ad93956213297c61748ec996", "payload_hash": "2c216d6615c900b053ae4d57d1d4ad0a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 8764, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "evidence": { "request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12f5857b0073f3e743f42b20d4172fb781a2faf8", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8764, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018", "tls_ja3": "4ae33de1ad93956213297c61748ec996", "tls_sni": "62.3.50.33", "port": 8764, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)", "evidence_snippet": "~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd", "target_port_label": "8764 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8764" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.68, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
01/08/2026 09:03:48 UTC	TCP	9023 · Sonde DevOps (GitLab/Portainer/ArgoCD)	devops-probe	Scan de ports port scan syn · via Sonde DevOps (GitLab/Portainer/ArgoCD):9023 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur DEVOPS-PROBE WAF — Recommandation Surveiller Tags devops_probe_emulated net_port_scan_slow tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9023 Chemin / cible — Service Sonde DevOps (GitLab/Portainer/ArgoCD) Payload ZV��)c}�34 ��9U`�{�x�>"��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ZV��)c}�34 ��9U`�{�x�>"��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�' Requête brute (extrait) ZV��)c}�34 ��9U`�{�x�>"��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P��=�<�5�/A ��;�k 62. Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a", "emulator_response_len": 43, "bytes_in": 351, "payload_entropy": 5.381095551885722, "port_category": "registered", "org": "Google LLC", "service": "devops-probe", "app_proto": "devops-probe", "asn": 396982, "country": "US", "dst_port": 9023, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fadef17fbfbe857adbca975016d2c0235abc5bf0", "event_fingerprint": "ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "devops-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1bf28fc299b035cc8c830442fa877c6e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9023, "service": "devops-probe", "service_name": "devops-probe", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd\b\ufffd\ufffd\u0017\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\u0011\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd\b\ufffd\ufffd\u0017\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\u0011\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.", "payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd\b\ufffd\ufffd\u0017\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\u0011\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61aeebe7938d8f542fc3267c80668ad4eea8537d", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd\b\ufffd\ufffd\u0017\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\u0011\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "evidence_snippet": "ZV\ufffd\ufffd\ufffd\ufffd\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "dst_port": 9023, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-devops-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\ufffd\b\ufffd\ufffd\u0017\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\u0011\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'", "port": 9023, "service": "devops-probe", "service_label_fr": "Sonde DevOps (GitLab\/Portainer\/ArgoCD)" }, "attack_vector": "port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)", "evidence_snippet": "ZV\ufffd\ufffd\ufffd\ufffd\ufffd)c}\ufffd34\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd>\"\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'", "target_port_label": "9023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)", "emulator_service": "devops-probe", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "devops_probe", "service_banner": "honeypot-devops-probe", "service_os": "linux", "dst_port": "9023" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.66, "multi_protocol_correlation": true, "multi_protocol_count": 45, "multi_protocol_sample": [ "clickhouse-http", "consul-server", "devops-probe", "github-webhook", "hdfs-namenode", "http", "http-alt-8004", "http-alt-8040" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.19.127.0\/24", "coordinated_ip_count": 28, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "devops_probe_emulated", "net_port_scan_slow", "tls_clienthello" ], "asn_dc_heuristic": true }

34.19.127.180

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence