|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1196e3b1fa255a44 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�u��H � ۠Jm6����"ݑa�&$�%p�� ��H"<۷�LmMW����ߑxf)$�r��i�H9�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�u��H � ۠Jm6����"ݑa�&$�%p�� ��H"<۷�LmMW����ߑxf)$�r��i�H9�
Requête brute (extrait)
~ zjm�u��H � ۠Jm6����"ݑa�&$�%p�� ��H"<۷�LmMW����ߑxf)$�r��i�H9� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.743775726941699,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "96df62d2472dccd1e762ec35f691e6c12f812165",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1196e3b1fa255a444a88617c122e45a5",
"payload_hash": "0cc76a829b9b3d7c530a5e4232cd1c57",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7c800797e83f8076d98177c50d77f1353ecc386",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (94 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 23,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1,
"multi_protocol_correlation": true,
"multi_protocol_count": 94,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041
|
—
|
Scan de ports
port scan syn · port 9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a001fe3a6edf7a73b9ddf983b1f39bc7d57d25ea",
"event_fingerprint": "bdccc188373f2a627c4246911139eb473194f137",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9041,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eedf812dd5c219e90d049d7e396e072bab81f4ea",
"protocol_details": {
"port": 9041
},
"attack_vector": "port scan syn \u00b7 port 9041 \u00b7 (reconnaissance)",
"target_port_label": "9041",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9041
},
"attack_vector": "port scan syn \u00b7 port 9041 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9041",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
� �9 �X4� ���0]�|h��c���H1h��x � �Dd_%`�_ �IN� �_B8��� ��[ye��� m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9 �X4�
���0]�|h��c���H1h��x � �Dd_%`�_ �IN�
�_B8���
��[ye���
m
62.3.50.33
�
Requête brute (extrait)
� �9 �X4� ���0]�|h��c���H1h��x � �Dd_%`�_ �IN� �_B8��� ��[ye��� m 62.3.50.33 � # * ( + - 3����_Vs��Zd��s�$x@�4�E.�h�=�M�L��Q�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 1481,
"payload_entropy": 7.740229817720961,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ea9d580453c609bbe2719ffc7e640b2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\u001c\ufffdX4\ufffd\n\ufffd\u001a\ufffd\ufffd0]\u0016\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\u0002\u001f\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\u001c\ufffdX4\ufffd\n\ufffd\u001a\ufffd\ufffd0]\u0016\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\u0002\u001f\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd_Vs\ufffd\ufffdZd\ufffd\ufffds\ufffd\u001a$x@\ufffd\u00144\ufffdE.\ufffdh\ufffd=\ufffdM\ufffdL\ufffd\ufffdQ\u000f\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\u001c\ufffdX4\ufffd\n\ufffd\u001a\ufffd\ufffd0]\u0016\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\u0002\u001f\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43fcd34a13862456ab179a501b8ef8a3cf171fbd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\u001c\ufffdX4\ufffd\n\ufffd\u001a\ufffd\ufffd0]\u0016\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\u0002\u001f\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffd9\ufffdX4\ufffd\n\ufffd\ufffd\ufffd0]\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\u001c\ufffdX4\ufffd\n\ufffd\u001a\ufffd\ufffd0]\u0016\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\u0002\u001f\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd9\ufffdX4\ufffd\n\ufffd\ufffd\ufffd0]\ufffd|h\ufffd\ufffdc\ufffd\ufffd\ufffdH1h\ufffd\ufffdx\ufffd \ufffdDd_%`\ufffd_\t\ufffdI\u0092N\ufffd\r\ufffd_B8\ufffd\ufffd\ufffd\r\ufffd\ufffd[ye\ufffd\ufffd\ufffd\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.28,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���̍.�ԏ+�D� �6J?�k�����g8� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���̍.�ԏ+�D� �6J?�k�����g8� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ���̍.�ԏ+�D� �6J?�k�����g8� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.797095359824286,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "0677f8952607e6a71534425e70538a3a95089fcc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "440990dbbbf9b89ad3ed1e983fc9207e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\b\u0016\u0019\u001b\ufffd\u030d.\ufffd\u050f+\ufffd\u000eD\ufffd\f\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\b\u0016\u0019\u001b\ufffd\u030d.\ufffd\u050f+\ufffd\u000eD\ufffd\f\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\b\u0016\u0019\u001b\ufffd\u030d.\ufffd\u050f+\ufffd\u000eD\ufffd\f\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d4241e7fd8c5514ddf2b6bc306481c37e46cd71b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\b\u0016\u0019\u001b\ufffd\u030d.\ufffd\u050f+\ufffd\u000eD\ufffd\f\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u030d.\ufffd\u050f+\ufffdD\ufffd\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\b\u0016\u0019\u001b\ufffd\u030d.\ufffd\u050f+\ufffd\u000eD\ufffd\f\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u030d.\ufffd\u050f+\ufffdD\ufffd\ufffd6J?\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdg8\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.28,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041
|
—
|
Scan de ports
port scan syn · port 9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Payload
�4 � � � � � @ � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�4 � � � � � @ � �
Meta JSON brut
{
"bytes_in": 54,
"payload_entropy": 3.705848099200768,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a001fe3a6edf7a73b9ddf983b1f39bc7d57d25ea",
"event_fingerprint": "bdccc188373f2a627c4246911139eb473194f137",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7b673fcc625b3fe0c577928300be63e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9041,
"risk_score": 42
},
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"evidence": {
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "692e6887d928f53ca6a9864a619f0be1adcb3411",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9041
},
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 port 9041 \u00b7 (reconnaissance)",
"target_port_label": "9041",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9041
},
"attack_vector": "port scan syn \u00b7 port 9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"target_port_label": "9041",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.27,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
SNI TLS
62.3.50.33
Payload
� �]*K��ǃ �����'V\��>����Cm}� )�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �]*K��ǃ �����'V\��>����Cm}�
)�� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �]*K��ǃ �����'V\��>����Cm}� )�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 175,
"payload_entropy": 4.828546354902016,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "536017f6fd0e95b1077083bbd9767b21",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002]*K\ufffd\ufffd\u01c3\f\u000b\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002]*K\ufffd\ufffd\u01c3\f\u000b\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002]*K\ufffd\ufffd\u01c3\f\u000b\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b4addb81942d8578003c3baa922485c89fec34d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002]*K\ufffd\ufffd\u01c3\f\u000b\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffd]*K\ufffd\ufffd\u01c3\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002]*K\ufffd\ufffd\u01c3\f\u000b\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd]*K\ufffd\ufffd\u01c3\ufffd\ufffd\ufffd\ufffd\ufffd'V\\\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdCm}\ufffd\n)\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.93,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 11,
"payload_entropy": 2.2221915755066783,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 23,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "2c5de8a90884df1cb9db9fae64b0dacd3e74c901",
"event_fingerprint": "be5737fa8405f469a7d908f6d4f206ec0b6aa5d0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "55b6c6b63391f7a244877208a3a6144c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "27bcca8a8ef69324c29a3058b8fb864676cc5091",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.91,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
~ zjm�t��H � ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$ �r��j�H8�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�t��H
� ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$
�r��j�H8�
Requête brute (extrait)
~ zjm�t��H � ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$ �r��j�H8� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 899,
"payload_entropy": 5.742100313366393,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "91a8b6f7b4c73e5cbcb046d352c95cd2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6504de5c256a50ed628443581ac1f06f9a95680e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "~zjm\ufffdt\ufffd\ufffdH\n\ufffd\u06dfJm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\ufffd",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdt\ufffd\ufffdH\n\ufffd\u06dfJm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\ufffd",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 e53406bbb3118b0c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�t��H � ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$ �r��j�H8�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�t��H
� ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$
�r��j�H8�
Requête brute (extrait)
~ zjm�t��H � ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$ �r��j�H8� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.743246476352636,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "dfdc266a18d7f7dfa47c81bba789653af26af3a6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "e53406bbb3118b0c8a662f6717ac159d",
"payload_hash": "be1ce011d232a66c25e3262da188b880",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10a4fb941d12e7789ed35e9a0053fe757729c0a6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdt\ufffd\ufffdH\n\ufffd\u06dfJm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdt\ufffd\ufffdH\n\ufffd\u06dfJm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\ufffd",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��D`P�nXr�ġ�C�D��� gʷ�P� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��D`P�nXr�ġ�C�D��� gʷ�P� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��D`P�nXr�ġ�C�D��� gʷ�P� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.834753019628759,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "7272ec20a6c6c93d6b8183acafc48dad4a4d71bb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "d5ab11b459aac55b4b6098570a369bca",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdD`P\ufffdnXr\ufffd\u0121\ufffd\u0011C\ufffdD\ufffd\u0002\ufffd\u000f\ufffd\tg\u02b7\ufffd\u0005P\ufffd\u001a\u001d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdD`P\ufffdnXr\ufffd\u0121\ufffd\u0011C\ufffdD\ufffd\u0002\ufffd\u000f\ufffd\tg\u02b7\ufffd\u0005P\ufffd\u001a\u001d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdD`P\ufffdnXr\ufffd\u0121\ufffd\u0011C\ufffdD\ufffd\u0002\ufffd\u000f\ufffd\tg\u02b7\ufffd\u0005P\ufffd\u001a\u001d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "248dd660644c94153d2e32363a2ce78936836a02",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdD`P\ufffdnXr\ufffd\u0121\ufffd\u0011C\ufffdD\ufffd\u0002\ufffd\u000f\ufffd\tg\u02b7\ufffd\u0005P\ufffd\u001a\u001d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdD`P\ufffdnXr\ufffd\u0121\ufffdC\ufffdD\ufffd\ufffd\ufffd\tg\u02b7\ufffdP\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdD`P\ufffdnXr\ufffd\u0121\ufffd\u0011C\ufffdD\ufffd\u0002\ufffd\u000f\ufffd\tg\u02b7\ufffd\u0005P\ufffd\u001a\u001d\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdD`P\ufffdnXr\ufffd\u0121\ufffdC\ufffdD\ufffd\ufffd\ufffd\tg\u02b7\ufffdP\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
Z VlUf�Y���?(�V�P q���k��%���� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z VlUf�Y���?(�V�P q���k��%���� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z VlUf�Y���?(�V�P q���k��%���� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 351,
"payload_entropy": 5.3759087850027685,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c399476665319c6081ca8a35c61f9fe0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003l\u0007Uf\ufffdY\ufffd\ufffd\ufffd?(\u0010\ufffdV\ufffdP\u001dq\ufffd\ufffd\ufffd\u000ek\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003l\u0007Uf\ufffdY\ufffd\ufffd\ufffd?(\u0010\ufffdV\ufffdP\u001dq\ufffd\ufffd\ufffd\u000ek\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003l\u0007Uf\ufffdY\ufffd\ufffd\ufffd?(\u0010\ufffdV\ufffdP\u001dq\ufffd\ufffd\ufffd\u000ek\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e52561bed8db6032745d83b39c0adc8636a6ee0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003l\u0007Uf\ufffdY\ufffd\ufffd\ufffd?(\u0010\ufffdV\ufffdP\u001dq\ufffd\ufffd\ufffd\u000ek\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "ZVlUf\ufffdY\ufffd\ufffd\ufffd?(\ufffdV\ufffdPq\ufffd\ufffd\ufffdk\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003l\u0007Uf\ufffdY\ufffd\ufffd\ufffd?(\u0010\ufffdV\ufffdP\u001dq\ufffd\ufffd\ufffd\u000ek\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVlUf\ufffdY\ufffd\ufffd\ufffd?(\ufffdV\ufffdPq\ufffd\ufffd\ufffdk\ufffd\ufffd%\ufffd\ufffd\u0082\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.83,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9034 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9034 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9034
Chemin / cible
—
Service
TLS
Payload
S O ?G���,��`~� ��{�Ֆ�w����<=�o�n ( f e d c b a `
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
S O ?G���,��`~� ��{�Ֆ�w����<=�o�n (
f e d c b a `
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 88,
"payload_entropy": 4.71356415999113,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9034,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 23,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "054a64935b4b5c731720f0bf7462630c757b6d5c",
"event_fingerprint": "5611d53f1ecd554b4d4b1af76d298cb92af045cc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "80ab07029d5f302cd55bfd003a3a37f1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9034,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c9af8f2fe3871d8b5d29d6421ee8ac375cb9219",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"port": 9034,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`",
"attack_vector": "port scan syn \u00b7 via TLS:9034 \u00b7 (reconnaissance)",
"target_port_label": "9034 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9034,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"port": 9034,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9034 \u00b7 (reconnaissance)",
"evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`",
"target_port_label": "9034 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9034"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
SNI TLS
62.3.50.33
Payload
� �����Q��� �o��Z���/���~��b���T�5 F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����Q��� �o��Z���/���~��b���T�5 F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �����Q��� �o��Z���/���~��b���T�5 F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 175,
"payload_entropy": 4.87335237678398,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e0afcef9f83e69e5f26a8f0712019d7d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "67625c3bd21c099689690498fb5b754e",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\u000f\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\u000f\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\u000f\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7211de788cd9d1af5585a5ad507a2069bf75c27",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\u000f\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\u000f\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\t\ufffdo\ufffd\ufffdZ\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd~\ufffd\ufffdb\ufffd\ufffd\ufffdT\ufffd5F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035
|
—
|
Scan de ports
port scan syn · port 9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c9e2f4bbe7af6269e108d23ac6e8e8374c8571e2",
"event_fingerprint": "1e12ac6b122f23d96a8292e650b7efdeecb86f97",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9035,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd4f5920e97d8f8d590d06be101c4042a0e3d6eb",
"protocol_details": {
"port": 9035
},
"attack_vector": "port scan syn \u00b7 port 9035 \u00b7 (reconnaissance)",
"target_port_label": "9035",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9035
},
"attack_vector": "port scan syn \u00b7 port 9035 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9035",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035
|
—
|
Scan de ports
port scan syn · port 9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Payload
�4 � � � � � @ � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�4 � � � � � @ � �
Meta JSON brut
{
"bytes_in": 54,
"payload_entropy": 3.705848099200768,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c9e2f4bbe7af6269e108d23ac6e8e8374c8571e2",
"event_fingerprint": "1e12ac6b122f23d96a8292e650b7efdeecb86f97",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7b673fcc625b3fe0c577928300be63e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9035,
"risk_score": 42
},
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"evidence": {
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84fb75bb3f89112589e2d5c4e1a957fcc52ff7bc",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9035
},
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 port 9035 \u00b7 (reconnaissance)",
"target_port_label": "9035",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9035
},
"attack_vector": "port scan syn \u00b7 port 9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"target_port_label": "9035",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.82,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
~ zjm�t��H � ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$ �r��j�H8�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�t��H
� ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$
�r��j�H8�
Requête brute (extrait)
~ zjm�t��H � ۟Jm5����#ݑ`�&$�&p�� ��H!=۶�LmLX����ߑwg)$ �r��j�H8� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 899,
"payload_entropy": 5.74281725858975,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "794100b8e4382504b4cedc67697f15c7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef008f1640ca46312eee6d1c4408166208855ea4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "~zjm\ufffdt\ufffd\ufffdH\n\ufffd\u06dfJm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\ufffd",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (93 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdt\ufffd\ufffdH\n\ufffd\u0000\u06df\u0014Jm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u0003\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdt\ufffd\ufffdH\n\ufffd\u06dfJm5\ufffd\ufffd\ufffd\ufffd#\u0751`\ufffd&$\ufffd&p\ufffd\ufffd \ufffd\ufffdH!=\u06f6\ufffdLmLX\ufffd\ufffd\ufffd\ufffd\u07d1wg)$\r\ufffdr\ufffd\ufffdj\ufffdH8\ufffd",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.82,
"multi_protocol_correlation": true,
"multi_protocol_count": 93,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a50a95b4f37870c7b13f0db7255f5123a62a4c99",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85e656b18b24a6e1be1743d494595738b325db82",
"protocol_details": {
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
�4 � � � � � @ � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�4 � � � � � @ � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 54,
"payload_entropy": 3.705848099200768,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a50a95b4f37870c7b13f0db7255f5123a62a4c99",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7b673fcc625b3fe0c577928300be63e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"evidence": {
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "baf48b81ceda22590fae6248f645121794adcea9",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9034
|
—
|
Scan de ports
port scan syn · port 9034 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9034
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9034,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "56c171e0a23905636a40e5e8179db70b066dcd5a",
"event_fingerprint": "371202a9985432302f8a6716789cd219f669f516",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9034,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0dc87da71fcb235619b0394f5dca44a3c9d33544",
"protocol_details": {
"port": 9034
},
"attack_vector": "port scan syn \u00b7 port 9034 \u00b7 (reconnaissance)",
"target_port_label": "9034",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9034,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9034
},
"attack_vector": "port scan syn \u00b7 port 9034 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9034",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9034"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
� �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 11,
"payload_entropy": 2.2221915755066783,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "55b6c6b63391f7a244877208a3a6144c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b08c895b3de3a10fc18987ef3cf8ded778a6d7a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
8104,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9034 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9034 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 16ee84a07b55074c
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9034
Chemin / cible
—
Service
TLS
Payload
i eU ��random1random2random3random4 / 9 � 0 , *
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
i eU ��random1random2random3random4 /
9 � 0
, *
Meta JSON brut
{
"tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 110,
"payload_entropy": 4.269606220838881,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9034,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f03f0d00088dac9e2fa73de2bb10f9f53854c408",
"event_fingerprint": "826aea8c40457cb612e392978c4ca9413580620f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "16ee84a07b55074cb2751329bf1c8811",
"payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "011b865e5f91ae5e1836c88110724dcb",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,47-10-19-57-4-255,13,,",
"tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb",
"tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9034,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68ad0c64ff1bbf17b2eb048e4c9c164265e93c0c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9034,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"attack_vector": "port scan syn \u00b7 via TLS:9034 \u00b7 (reconnaissance)",
"target_port_label": "9034 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9034,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9034,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9034 \u00b7 (reconnaissance)",
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"target_port_label": "9034 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9034"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
~ zjm�s�H { ۞Jm4����ݑ_�&$� p�� ��H 6۵�LmKI����ߑvX)$ �r��c�H7�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�s�H { ۞Jm4����ݑ_�&$� p�� ��H 6۵�LmKI����ߑvX)$ �r��c�H7�
Requête brute (extrait)
~ zjm�s�H { ۞Jm4����ݑ_�&$� p�� ��H 6۵�LmKI����ߑvX)$ �r��c�H7� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 899,
"payload_entropy": 5.742848681135205,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "36dff9c6a0641da00252e9d5bf34681e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffds\ufffdH\t{\u0000\u06de\u0005Jm4\ufffd\ufffd\ufffd\ufffd\u0014\u0751_\ufffd&$\ufffd\u001fp\ufffd\ufffd \ufffd\ufffdH 6\u0003\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\f\ufffdr\ufffd\ufffdc\ufffdH7\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffds\ufffdH\t{\u0000\u06de\u0005Jm4\ufffd\ufffd\ufffd\ufffd\u0014\u0751_\ufffd&$\ufffd\u001fp\ufffd\ufffd \ufffd\ufffdH 6\u0003\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\f\ufffdr\ufffd\ufffdc\ufffdH7\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffds\ufffdH\t{\u0000\u06de\u0005Jm4\ufffd\ufffd\ufffd\ufffd\u0014\u0751_\ufffd&$\ufffd\u001fp\ufffd\ufffd \ufffd\ufffdH 6\u0003\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\f\ufffdr\ufffd\ufffdc\ufffdH7\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31a03eef099a774dfd037fab679f6e49f08038a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffds\ufffdH\t{\u0000\u06de\u0005Jm4\ufffd\ufffd\ufffd\ufffd\u0014\u0751_\ufffd&$\ufffd\u001fp\ufffd\ufffd \ufffd\ufffdH 6\u0003\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\f\ufffdr\ufffd\ufffdc\ufffdH7\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "~zjm\ufffds\ufffdH\t{\u06deJm4\ufffd\ufffd\ufffd\ufffd\u0751_\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH 6\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\ufffdr\ufffd\ufffdc\ufffdH7\ufffd",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffds\ufffdH\t{\u0000\u06de\u0005Jm4\ufffd\ufffd\ufffd\ufffd\u0014\u0751_\ufffd&$\ufffd\u001fp\ufffd\ufffd \ufffd\ufffdH 6\u0003\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\f\ufffdr\ufffd\ufffdc\ufffdH7\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffds\ufffdH\t{\u06deJm4\ufffd\ufffd\ufffd\ufffd\u0751_\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH 6\u06f5\ufffdLmKI\ufffd\ufffd\ufffd\ufffd\u07d1vX)$\ufffdr\ufffd\ufffdc\ufffdH7\ufffd",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.64,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
Z V } ��Prh5�/�z����(:-�ӎ�QQ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z V } ��Prh5�/�z����(:-�ӎ�QQ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z V } ��Prh5�/�z����(:-�ӎ�QQ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 351,
"payload_entropy": 5.3346094235742845,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ecfcc14b102ebe7a7786f7e9f7988adb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u001f\u0005} \ufffd\ufffd\u0007Prh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\u0006\u0004\ufffd(:\u0001-\ufffd\u04ce\ufffdQQ\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u001f\u0005} \ufffd\ufffd\u0007Prh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\u0006\u0004\ufffd(:\u0001-\ufffd\u04ce\ufffdQQ\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u001f\u0005} \ufffd\ufffd\u0007Prh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\u0006\u0004\ufffd(:\u0001-\ufffd\u04ce\ufffdQQ\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c7467536ec54eff6e72ad960628d52ca215d367",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u001f\u0005} \ufffd\ufffd\u0007Prh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\u0006\u0004\ufffd(:\u0001-\ufffd\u04ce\ufffdQQ\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "ZV} \ufffd\ufffdPrh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\ufffd(:-\ufffd\u04ce\ufffdQQ\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (90 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u001f\u0005} \ufffd\ufffd\u0007Prh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\u0006\u0004\ufffd(:\u0001-\ufffd\u04ce\ufffdQQ\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "ZV} \ufffd\ufffdPrh5\ufffd\/\ufffdz\ufffd\ufffd\ufffd\ufffd(:-\ufffd\u04ce\ufffdQQ\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 90,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
SNI TLS
62.3.50.33
Payload
� �x�moړpq۹R�J�:4�Ą�B�̬� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �x�moړpq۹R�J�:4�Ą�B�̬� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �x�moړpq۹R�J�:4�Ą�B�̬� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 175,
"payload_entropy": 4.9070674312404945,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2aa73ebed90f51f21a2e6203086fab41",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002x\ufffdm\u000eo\u0693pq\u06f9R\ufffdJ\ufffd:\u00044\u05f9\ufffd\u0104\ufffd\u07b5\u0005B\ufffd\u032c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002x\ufffdm\u000eo\u0693pq\u06f9R\ufffdJ\ufffd:\u00044\u05f9\ufffd\u0104\ufffd\u07b5\u0005B\ufffd\u032c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002x\ufffdm\u000eo\u0693pq\u06f9R\ufffdJ\ufffd:\u00044\u05f9\ufffd\u0104\ufffd\u07b5\u0005B\ufffd\u032c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e4ccf5187dd1e70f7e546000a3d05e1ad81d5f2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002x\ufffdm\u000eo\u0693pq\u06f9R\ufffdJ\ufffd:\u00044\u05f9\ufffd\u0104\ufffd\u07b5\u0005B\ufffd\u032c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffdx\ufffdmo\u0693pq\u06f9R\ufffdJ\ufffd:4\u05f9\ufffd\u0104\ufffd\u07b5B\ufffd\u032c\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (90 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002x\ufffdm\u000eo\u0693pq\u06f9R\ufffdJ\ufffd:\u00044\u05f9\ufffd\u0104\ufffd\u07b5\u0005B\ufffd\u032c\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdx\ufffdmo\u0693pq\u06f9R\ufffdJ\ufffd:4\u05f9\ufffd\u0104\ufffd\u07b5B\ufffd\u032c\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 90,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
SNI TLS
62.3.50.33
Payload
� ��u��B��� �LɅWs�8)v~<T��-� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��u��B��� �LɅWs�8)v~<T��-� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��u��B��� �LɅWs�8)v~<T��-� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 175,
"payload_entropy": 4.849685465640687,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "87b87601f0f5582d4757b582c3e4fc3a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "67625c3bd21c099689690498fb5b754e",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdu\ufffd\u001a\ufffdB\ufffd\u0001\ufffd\ufffd\f\u00ad\ufffdL\u0245Ws\ufffd8)\u001bv~\u001a<T\ufffd\ufffd-\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdu\ufffd\u001a\ufffdB\ufffd\u0001\ufffd\ufffd\f\u00ad\ufffdL\u0245Ws\ufffd8)\u001bv~\u001a<T\ufffd\ufffd-\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdu\ufffd\u001a\ufffdB\ufffd\u0001\ufffd\ufffd\f\u00ad\ufffdL\u0245Ws\ufffd8)\u001bv~\u001a<T\ufffd\ufffd-\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6585c70585c5a7d4d59f3972941b3701a8036d81",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdu\ufffd\u001a\ufffdB\ufffd\u0001\ufffd\ufffd\f\u00ad\ufffdL\u0245Ws\ufffd8)\u001bv~\u001a<T\ufffd\ufffd-\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffd\ufffdu\ufffd\ufffdB\ufffd\ufffd\ufffd\u00ad\ufffdL\u0245Ws\ufffd8)v~<T\ufffd\ufffd-\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (90 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdu\ufffd\u001a\ufffdB\ufffd\u0001\ufffd\ufffd\f\u00ad\ufffdL\u0245Ws\ufffd8)\u001bv~\u001a<T\ufffd\ufffd-\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdu\ufffd\ufffdB\ufffd\ufffd\ufffd\u00ad\ufffdL\u0245Ws\ufffd8)v~<T\ufffd\ufffd-\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 90,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
� �?��(�L����^�7m�X��V�\�3q ��� �� aZ �35� � �� ]���Ӭ-��A�3 ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �?��(�L����^�7m�X��V�\�3q ��� ��
aZ �35�
� �� ]���Ӭ-��A�3 ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� �?��(�L����^�7m�X��V�\�3q ��� �� aZ �35� � �� ]���Ӭ-��A�3 ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 1695,
"payload_entropy": 7.5904065425713645,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df9dc2002903ef59fea5dfe889ff6f7f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\u0004\ufffd\ufffd\u0016V\ufffd\\\ufffd3q\f\u0011\ufffd\ufffd\u0006\ufffd \ufffd\ufffd\naZ\u001c\ufffd35\ufffd\u001c\n\ufffd\u0005\u0000\ufffd\u000f\ufffd\u0000]\ufffd\ufffd\ufffd\u04ec\u0019-\ufffd\ufffdA\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\u0004\ufffd\ufffd\u0016V\ufffd\\\ufffd3q\f\u0011\ufffd\ufffd\u0006\ufffd \ufffd\ufffd\naZ\u001c\ufffd35\ufffd\u001c\n\ufffd\u0005\u0000\ufffd\u000f\ufffd\u0000]\ufffd\ufffd\ufffd\u04ec\u0019-\ufffd\ufffdA\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\u0004\ufffd\ufffd\u0016V\ufffd\\\ufffd3q\f\u0011\ufffd\ufffd\u0006\ufffd \ufffd\ufffd\naZ\u001c\ufffd35\ufffd\u001c\n\ufffd\u0005\u0000\ufffd\u000f\ufffd\u0000]\ufffd\ufffd\ufffd\u04ec\u0019-\ufffd\ufffdA\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a5c42b1d93f6ba1b063488c8ba2d772955838f5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\u0004\ufffd\ufffd\u0016V\ufffd\\\ufffd3q\f\u0011\ufffd\ufffd\u0006\ufffd \ufffd\ufffd\naZ\u001c\ufffd35\ufffd\u001c\n\ufffd\u0005\u0000\ufffd\u000f\ufffd\u0000]\ufffd\ufffd\ufffd\u04ec\u0019-\ufffd\ufffdA\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffd?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\ufffd\ufffdV\ufffd\\\ufffd3q\ufffd\ufffd\ufffd \ufffd\ufffd\naZ\ufffd35\ufffd\n\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u04ec-\ufffd\ufffdA\ufffd3\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\u0004\ufffd\ufffd\u0016V\ufffd\\\ufffd3q\f\u0011\ufffd\ufffd\u0006\ufffd \ufffd\ufffd\naZ\u001c\ufffd35\ufffd\u001c\n\ufffd\u0005\u0000\ufffd\u000f\ufffd\u0000]\ufffd\ufffd\ufffd\u04ec\u0019-\ufffd\ufffdA\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd?\ufffd\ufffd(\ufffdL\ufffd\ufffd\ufffd\ufffd^\ufffd7m\ufffdX\ufffd\ufffdV\ufffd\\\ufffd3q\ufffd\ufffd\ufffd \ufffd\ufffd\naZ\ufffd35\ufffd\n\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u04ec-\ufffd\ufffdA\ufffd3\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
Z Vj7;c6 �g��ܫ��i����|���KQ�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z Vj7;c6 �g��ܫ��i����|���KQ�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z Vj7;c6 �g��ܫ��i����|���KQ�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 351,
"payload_entropy": 5.347134239503879,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a191a8c41426f4d53a98ec34c1f08d31",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003j7;c6\u001d\ufffdg\ufffd\ufffd\u0019\u072b\ufffd\u000f\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\u0012\u0017K\u0017Q\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003j7;c6\u001d\ufffdg\ufffd\ufffd\u0019\u072b\ufffd\u000f\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\u0012\u0017K\u0017Q\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003j7;c6\u001d\ufffdg\ufffd\ufffd\u0019\u072b\ufffd\u000f\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\u0012\u0017K\u0017Q\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49db6469fc0d313ca001e4de9d954a69431cb801",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003j7;c6\u001d\ufffdg\ufffd\ufffd\u0019\u072b\ufffd\u000f\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\u0012\u0017K\u0017Q\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "ZVj7;c6\ufffdg\ufffd\ufffd\u072b\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffdKQ\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003j7;c6\u001d\ufffdg\ufffd\ufffd\u0019\u072b\ufffd\u000f\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffd\u0012\u0017K\u0017Q\ufffd\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVj7;c6\ufffdg\ufffd\ufffd\u072b\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffdKQ\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
� �jm�p��H ۛJm1����ݑ\�&$�"p�� ��H 9۲�LmHL����ߑs[)$ �r��f�H4 f 62.3.50.33 # 0
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �jm�p��H ۛJm1����ݑ\�&$�"p�� ��H 9۲�LmHL����ߑs[)$ �r��f�H4
f
62.3.50.33 #
0
Requête brute (extrait)
� �jm�p��H ۛJm1����ݑ\�&$�"p�� ��H 9۲�LmHL����ߑs[)$ �r��f�H4 f 62.3.50.33 # 0 . �c� 3�� B�Yf��kkX�P�x��2��F�Cv�y���!�W\G��i��Ř
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 1474,
"payload_entropy": 7.7627258070388,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2bc99b0169acfd47cfefd72c2685c0e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdp\ufffd\ufffdH\u0006\u0000\u06db\bJm1\ufffd\ufffd\ufffd\ufffd\u0017\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH\u001d9\u0003\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdp\ufffd\ufffdH\u0006\u0000\u06db\bJm1\ufffd\ufffd\ufffd\ufffd\u0017\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH\u001d9\u0003\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 B\ufffdYf\ufffd\ufffdkkX\ufffdP\ufffdx\ufffd\ufffd2\ufffd\ufffdF\ufffdCv\ufffdy\ufffd\ufffd\ufffd!\ufffdW\\G\u0011\ufffd\u0004\ufffdi\ufffd\ufffd\u0158",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdp\ufffd\ufffdH\u0006\u0000\u06db\bJm1\ufffd\ufffd\ufffd\ufffd\u0017\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH\u001d9\u0003\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "510a1f4cdf339a5b37883a0365067af1a950b231",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdp\ufffd\ufffdH\u0006\u0000\u06db\bJm1\ufffd\ufffd\ufffd\ufffd\u0017\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH\u001d9\u0003\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffdjm\ufffdp\ufffd\ufffdH\u06dbJm1\ufffd\ufffd\ufffd\ufffd\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH9\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\nf\r\n62.3.50.33#\r0",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdp\ufffd\ufffdH\u0006\u0000\u06db\bJm1\ufffd\ufffd\ufffd\ufffd\u0017\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH\u001d9\u0003\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdjm\ufffdp\ufffd\ufffdH\u06dbJm1\ufffd\ufffd\ufffd\ufffd\u0751\\\ufffd&$\ufffd\"p\ufffd\ufffd \ufffd\ufffdH9\u06f2\ufffdLmHL\ufffd\ufffd\ufffd\ufffd\u07d1s[)$\t\ufffdr\ufffd\ufffdf\ufffdH4\nf\r\n62.3.50.33#\r0",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
� ��\�c��g��s��#�Yqٯ��{3���� �s<q��o�����NQ ��O R�x�_> m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��\�c��g��s��#�Yqٯ��{3���� �s<q��o�����NQ ��O R�x�_>
m
62.3.50.33
�
Requête brute (extrait)
� ��\�c��g��s��#�Yqٯ��{3���� �s<q��o�����NQ ��O R�x�_> m 62.3.50.33 � # * ( + - 3����pr(� :� B�FwE�C��Ј&L���U灻�Հ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 1481,
"payload_entropy": 7.716829152393926,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c633f33fad780a54df282cb464b8d876",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffd\u0006\u0014Yq\u066f\ufffd\u000f\ufffd{3\ufffd\u0001\ufffd\u0013\ufffd\ufffd \ufffds<\u0006q\ufffd\ufffdo\ufffd\u0001\ufffd\ufffd\ufffd\u0013\ufffdNQ\u001d\ufffd\ufffdO\u001d\u0000R\ufffdx\ufffd_\u0007\u001a>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffd\u0006\u0014Yq\u066f\ufffd\u000f\ufffd{3\ufffd\u0001\ufffd\u0013\ufffd\ufffd \ufffds<\u0006q\ufffd\ufffdo\ufffd\u0001\ufffd\ufffd\ufffd\u0013\ufffdNQ\u001d\ufffd\ufffdO\u001d\u0000R\ufffdx\ufffd_\u0007\u001a>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdpr(\ufffd\u0000:\ufffd\u000bB\ufffd\u0004FwE\ufffdC\ufffd\ufffd\u0408&L\ufffd\ufffd\ufffdU\u707b\ufffd\u0540\u0011",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffd\u0006\u0014Yq\u066f\ufffd\u000f\ufffd{3\ufffd\u0001\ufffd\u0013\ufffd\ufffd \ufffds<\u0006q\ufffd\ufffdo\ufffd\u0001\ufffd\ufffd\ufffd\u0013\ufffdNQ\u001d\ufffd\ufffdO\u001d\u0000R\ufffdx\ufffd_\u0007\u001a>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e219f13006096ad6a537536fd596912fb32b468",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffd\u0006\u0014Yq\u066f\ufffd\u000f\ufffd{3\ufffd\u0001\ufffd\u0013\ufffd\ufffd \ufffds<\u0006q\ufffd\ufffdo\ufffd\u0001\ufffd\ufffd\ufffd\u0013\ufffdNQ\u001d\ufffd\ufffdO\u001d\u0000R\ufffdx\ufffd_\u0007\u001a>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffdYq\u066f\ufffd\ufffd{3\ufffd\ufffd\ufffd\ufffd \ufffds<q\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffdNQ\ufffd\ufffdOR\ufffdx\ufffd_>\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffd\u0006\u0014Yq\u066f\ufffd\u000f\ufffd{3\ufffd\u0001\ufffd\u0013\ufffd\ufffd \ufffds<\u0006q\ufffd\ufffdo\ufffd\u0001\ufffd\ufffd\ufffd\u0013\ufffdNQ\u001d\ufffd\ufffdO\u001d\u0000R\ufffdx\ufffd_\u0007\u001a>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\\\ufffdc\ufffd\ufffdg\ufffd\ufffds\ufffd\ufffd#\ufffdYq\u066f\ufffd\ufffd{3\ufffd\ufffd\ufffd\ufffd \ufffds<q\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffdNQ\ufffd\ufffdOR\ufffdx\ufffd_>\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
~ zjm�o��H� ۚ)Jm0����Xݑ[�&$�p�� �H �۱GMmGݖ��t��r *$�s��?�H3�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�o��H� ۚ)Jm0����Xݑ[�&$�p�� �H �۱GMmGݖ��t��r *$�s��?�H3�
Requête brute (extrait)
~ zjm�o��H� ۚ)Jm0����Xݑ[�&$�p�� �H �۱GMmGݖ��t��r *$�s��?�H3� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 899,
"payload_entropy": 5.7246500625008325,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "30927d0e1c8d871bf6f1e6efcbb30c01",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdo\ufffd\ufffdH\u0005\ufffd\u0000\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \u001e\ufffdH\u001c\ufffd\u0003\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr\f*$\b\ufffds\ufffd\ufffd?\ufffdH3\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdo\ufffd\ufffdH\u0005\ufffd\u0000\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \u001e\ufffdH\u001c\ufffd\u0003\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr\f*$\b\ufffds\ufffd\ufffd?\ufffdH3\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdo\ufffd\ufffdH\u0005\ufffd\u0000\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \u001e\ufffdH\u001c\ufffd\u0003\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr\f*$\b\ufffds\ufffd\ufffd?\ufffdH3\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c481636afc702b786af839211b36e7f889e81c2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdo\ufffd\ufffdH\u0005\ufffd\u0000\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \u001e\ufffdH\u001c\ufffd\u0003\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr\f*$\b\ufffds\ufffd\ufffd?\ufffdH3\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "~zjm\ufffdo\ufffd\ufffdH\ufffd\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \ufffdH\ufffd\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr*$\ufffds\ufffd\ufffd?\ufffdH3\ufffd",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdo\ufffd\ufffdH\u0005\ufffd\u0000\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \u001e\ufffdH\u001c\ufffd\u0003\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr\f*$\b\ufffds\ufffd\ufffd?\ufffdH3\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdo\ufffd\ufffdH\ufffd\u06da)Jm0\ufffd\ufffd\ufffd\ufffdX\u0751[\ufffd&$\ufffdp\ufffd\ufffd \ufffdH\ufffd\u06f1GMmG\u0756\ufffd\ufffdt\ufffd\ufffdr*$\ufffds\ufffd\ufffd?\ufffdH3\ufffd",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
SNI TLS
62.3.50.33
Payload
� ��z+�{.���n��n�Ξ�@�V��gܔ�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��z+�{.���n��n�Ξ�@�V��gܔ�� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��z+�{.���n��n�Ξ�@�V��gܔ�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 175,
"payload_entropy": 4.8819796625229905,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f76293151011c66f8e5adab6330412e6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "67625c3bd21c099689690498fb5b754e",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdz+\ufffd{.\ufffd\ufffd\ufffd\u001an\u0012\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdz+\ufffd{.\ufffd\ufffd\ufffd\u001an\u0012\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdz+\ufffd{.\ufffd\ufffd\ufffd\u001an\u0012\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5cf0a6b309ac10b9b258e212f8440ad0247b3e2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdz+\ufffd{.\ufffd\ufffd\ufffd\u001an\u0012\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffd\ufffdz+\ufffd{.\ufffd\ufffd\ufffdn\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdz+\ufffd{.\ufffd\ufffd\ufffd\u001an\u0012\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdz+\ufffd{.\ufffd\ufffd\ufffdn\ufffd\ufffdn\ufffd\u039e\ufffd@\ufffdV\ufffd\ufffd\u0095g\u0714\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
~ zjm�n��H� ۙ*Jm/����YݑZ�&$��p�� �H�۰GMmFޖ��t��q *$�s��@�H2�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�n��H� ۙ*Jm/����YݑZ�&$��p�� �H�۰GMmFޖ��t��q
*$�s��@�H2�
Requête brute (extrait)
~ zjm�n��H� ۙ*Jm/����YݑZ�&$��p�� �H�۰GMmFޖ��t��q *$�s��@�H2� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 899,
"payload_entropy": 5.725056317741772,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b4b168a3467c4eac352aefcce35c0c24",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97b39d2ab5f1d2ffb85b3d193df6ff42398a3f77",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "~zjm\ufffdn\ufffd\ufffdH\ufffd\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \ufffdH\ufffd\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\ufffds\ufffd\ufffd@\ufffdH2\ufffd",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdn\ufffd\ufffdH\ufffd\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \ufffdH\ufffd\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\ufffds\ufffd\ufffd@\ufffdH2\ufffd",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
SNI TLS
62.3.50.33
Payload
� �4�w �n2�R��.y"�И*�ާfP�ٽ�G�5j F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4�w �n2�R��.y"�И*�ާfP�ٽ�G�5j F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �4�w �n2�R��.y"�И*�ާfP�ٽ�G�5j F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 175,
"payload_entropy": 4.8622614093585295,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df6474d3e0e43517ef4f91ba5a53a317",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00024\ufffdw\u000b\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5j\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00024\ufffdw\u000b\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5j\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00024\ufffdw\u000b\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5j\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62a50ee768800c4469917fe74ef12660258ad106",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00024\ufffdw\u000b\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5j\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffd4\ufffdw\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5jF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00024\ufffdw\u000b\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5j\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd4\ufffdw\ufffdn2\ufffdR\ufffd\ufffd.y\"\ufffd\u0418*\ufffd\u07a7fP\ufffd\u067d\ufffdG\ufffd5jF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ff79cbd997acba48888a59c128ecda151a1a6110",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "646218db3abfc5ba2888c2f3f1282aa280fc7a5b",
"protocol_details": {
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
�4 � � � � � @ � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�4 � � � � � @ � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 54,
"payload_entropy": 3.705848099200768,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ff79cbd997acba48888a59c128ecda151a1a6110",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7b673fcc625b3fe0c577928300be63e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"evidence": {
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "221b04bc97ce88383771733f08f2c36ea77b423f",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
� �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 11,
"payload_entropy": 2.2221915755066783,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "55b6c6b63391f7a244877208a3a6144c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e68e8b422602ab9d448198070669b8df928a0783",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (92 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 92,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
Scan de ports
port scan syn · via Webhook GitHub:9011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
~ zjm�n��H� ۙ*Jm/����YݑZ�&$��p�� �H�۰GMmFޖ��t��q *$�s��@�H2�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�n��H� ۙ*Jm/����YݑZ�&$��p�� �H�۰GMmFޖ��t��q
*$�s��@�H2�
Requête brute (extrait)
~ zjm�n��H� ۙ*Jm/����YݑZ�&$��p�� �H�۰GMmFޖ��t��q *$�s��@�H2� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 899,
"payload_entropy": 5.725485535504657,
"port_category": "registered",
"org": "Google LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 396982,
"country": "US",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ebe7ae64050ee5ecf11b57ea40101b7574912ecc",
"event_fingerprint": "46856d4e4ebf8902346c2f8d1e76669759fb3eb8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9ed7ca349f23e06e3c24472bf857da21",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bff5fbb44e4d3a184a7ccfb0627e76e5c7514f9e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "~zjm\ufffdn\ufffd\ufffdH\ufffd\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \ufffdH\ufffd\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\ufffds\ufffd\ufffd@\ufffdH2\ufffd",
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdn\ufffd\ufffdH\u0004\ufffd\u0000\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \u001e\ufffdH\u001b\ufffd\u0003\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\u0007\ufffds\ufffd\ufffd@\ufffdH2\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdn\ufffd\ufffdH\ufffd\u06d9*Jm\/\ufffd\ufffd\ufffd\ufffdY\u0751Z\ufffd&$\ufffd\ufffdp\ufffd\ufffd \ufffdH\ufffd\u06f0GMmF\u0796\ufffd\ufffdt\ufffd\ufffdq\r*$\ufffds\ufffd\ufffd@\ufffdH2\ufffd",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http",
"http-alt-8004"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8911 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8911 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8911
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �uq�5�k?Q0� B5 س� ��.�ː4�e���~ F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �uq�5�k?Q0� B5 س�
��.�ː4�e���~ F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �uq�5�k?Q0� B5 س� ��.�ː4�e���~ F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.83559333026906,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8911,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "12ba9544a2254c7126fa4ede5ae54fc26eb02322",
"event_fingerprint": "0c0f6ea767b02d0268d40563d99c7cbb9eb57985",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "a8e0384cfa684cab148e3c44bf3d1324",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 8911,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002uq\ufffd5\ufffdk?Q0\ufffd\u0000B5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\u0005\ufffde\ufffd\ufffd\ufffd~\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002uq\ufffd5\ufffdk?Q0\ufffd\u0000B5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\u0005\ufffde\ufffd\ufffd\ufffd~\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002uq\ufffd5\ufffdk?Q0\ufffd\u0000B5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\u0005\ufffde\ufffd\ufffd\ufffd~\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f6d4ab3127de924f5d387011cc333efca43d616d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002uq\ufffd5\ufffdk?Q0\ufffd\u0000B5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\u0005\ufffde\ufffd\ufffd\ufffd~\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffduq\ufffd5\ufffdk?Q0\ufffdB5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\ufffde\ufffd\ufffd\ufffd~F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8911,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002uq\ufffd5\ufffdk?Q0\ufffd\u0000B5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\u0005\ufffde\ufffd\ufffd\ufffd~\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffduq\ufffd5\ufffdk?Q0\ufffdB5 \u0633\ufffd\r\ufffd\ufffd.\ufffd\u02d04\ufffde\ufffd\ufffd\ufffd~F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.81,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���sT�;F����eA�xd� ��?����^� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���sT�;F����eA�xd� ��?����^� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ���sT�;F����eA�xd� ��?����^� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.884210288383352,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89d28a04b046802a1562cace25fc16f6f959d70",
"event_fingerprint": "1bb8d6684728ec6a5d5da145b32d4ad9142ae7b8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "aecca20e341248419fc8b85a38f30a83",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\u0002\u0007\ufffd\ufffdeA\ufffdxd\ufffd\u000b\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\u0002\u0007\ufffd\ufffdeA\ufffdxd\ufffd\u000b\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\u0002\u0007\ufffd\ufffdeA\ufffdxd\ufffd\u000b\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "189b29d278f718476d06811a41990fbb712fc81f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\u0002\u0007\ufffd\ufffdeA\ufffdxd\ufffd\u000b\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\ufffd\ufffdeA\ufffdxd\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\u0002\u0007\ufffd\ufffdeA\ufffdxd\ufffd\u000b\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdsT\ufffd;F\ufffd\ufffd\ufffd\ufffdeA\ufffdxd\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd^\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.8,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���c�E>~�T�� ��3� �j�^�4� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���c�E>~�T��
��3�
�j�^�4� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ���c�E>~�T�� ��3� �j�^�4� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.807011574072913,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89d28a04b046802a1562cace25fc16f6f959d70",
"event_fingerprint": "1bb8d6684728ec6a5d5da145b32d4ad9142ae7b8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "44447d63ccd0d4adce0924a011331205",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u000e\ufffdc\ufffd\u0015E\u0004>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\u001e\u0013\r\ufffdj\u0003\u0083\ufffd^\ufffd4\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u000e\ufffdc\ufffd\u0015E\u0004>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\u001e\u0013\r\ufffdj\u0003\u0083\ufffd^\ufffd4\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u000e\ufffdc\ufffd\u0015E\u0004>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\u001e\u0013\r\ufffdj\u0003\u0083\ufffd^\ufffd4\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63d512974abf7f12fc9667892095d11b5113675d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u000e\ufffdc\ufffd\u0015E\u0004>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\u001e\u0013\r\ufffdj\u0003\u0083\ufffd^\ufffd4\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdc\ufffdE>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\r\ufffdj\u0083\ufffd^\ufffd4\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd\u000e\ufffdc\ufffd\u0015E\u0004>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\u001e\u0013\r\ufffdj\u0003\u0083\ufffd^\ufffd4\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdc\ufffdE>~\ufffdT\ufffd\ufffd\n\ufffd\ufffd3\ufffd\r\ufffdj\u0083\ufffd^\ufffd4\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.82,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� � I��&p{�q �,f��.�IX������x�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � I��&p{�q �,f��.�IX������x�� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� � I��&p{�q �,f��.�IX������x�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.898630140653388,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89d28a04b046802a1562cace25fc16f6f959d70",
"event_fingerprint": "d4b247aabb0c6d5d860a7a2a783bc245643c6f0d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "72b4051cd6dea46bc29623ade70c86ad",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001fI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001fI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001fI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66d2be2ac864fdd55b7f2367ab69403222b4c402",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001fI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001fI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdI\ufffd\u0429\ufffd&p{\ufffdq \ufffd,f\ufffd\ufffd.\ufffdIX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8911 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8911 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8911
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �$7�����@K��+ �BF^N5xO'��4�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �$7�����@K��+ �BF^N5xO'��4�� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �$7�����@K��+ �BF^N5xO'��4�� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.869038733914474,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8911,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "12ba9544a2254c7126fa4ede5ae54fc26eb02322",
"event_fingerprint": "b1846792647b61a3fb52188b89f7806b38bbc4ac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "7a0075d01e0e549f98aa17ed424c3700",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8911,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\u0015\ufffd\ufffd+\f\ufffdBF\b^N5xO'\ufffd\ufffd4\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\u0015\ufffd\ufffd+\f\ufffdBF\b^N5xO'\ufffd\ufffd4\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\u0015\ufffd\ufffd+\f\ufffdBF\b^N5xO'\ufffd\ufffd4\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8bd9e733789efd4cf9aac0e62698877ccd009df",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\u0015\ufffd\ufffd+\f\ufffdBF\b^N5xO'\ufffd\ufffd4\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\ufffd\ufffd+\ufffdBF^N5xO'\ufffd\ufffd4\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8911,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\u0015\ufffd\ufffd+\f\ufffdBF\b^N5xO'\ufffd\ufffd4\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd$7\ufffd\ufffd\ufffd\ufffd\u00cd\ufffd@K\ufffd\ufffd+\ufffdBF^N5xO'\ufffd\ufffd4\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �@�sA>�$�)%�G�Njp ��<p�r��1| F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �@�sA>�$�)%�G�Njp ��<p�r��1| F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �@�sA>�$�)%�G�Njp ��<p�r��1| F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.850495233926837,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89d28a04b046802a1562cace25fc16f6f959d70",
"event_fingerprint": "d4b247aabb0c6d5d860a7a2a783bc245643c6f0d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "bbdaef3070ab020eac758b22ddaf5110",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdN\u0015jp\u001d\ufffd\u0015\ufffd\b<\u0019p\ufffdr\ufffd\u0017\ufffd1|\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdN\u0015jp\u001d\ufffd\u0015\ufffd\b<\u0019p\ufffdr\ufffd\u0017\ufffd1|\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdN\u0015jp\u001d\ufffd\u0015\ufffd\b<\u0019p\ufffdr\ufffd\u0017\ufffd1|\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f8250ec3229b2de32b3b0a32fc2e938ddddb49b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdN\u0015jp\u001d\ufffd\u0015\ufffd\b<\u0019p\ufffdr\ufffd\u0017\ufffd1|\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdNjp\ufffd\ufffd<p\ufffdr\ufffd\ufffd1|F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdN\u0015jp\u001d\ufffd\u0015\ufffd\b<\u0019p\ufffdr\ufffd\u0017\ufffd1|\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd@\ufffdsA>\ufffd$\ufffd)%\ufffdG\ufffdNjp\ufffd\ufffd<p\ufffdr\ufffd\ufffd1|F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8911 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8911 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 de8c366fbb06bedc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8911
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��6���ɚA��e�1HQuxBp�D�D$�L Fr!�����qy�Q|��˦�*�oB�gt�] m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��6���ɚA��e�1HQuxBp�D�D$�L Fr!�����qy�Q|��˦�*�oB�gt�]
m
62.3.50.33
�
Requête brute (extrait)
� ��6���ɚA��e�1HQuxBp�D�D$�L Fr!�����qy�Q|��˦�*�oB�gt�] m 62.3.50.33 � # * ( + - 3����;����y�s�g0Bxl�5�f��U��Ȝ� �,���
Meta JSON brut
{
"tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"bytes_in": 1481,
"payload_entropy": 7.733435401572566,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8911,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e249e55b3d806338bde9f713b0eb822283b7378e",
"event_fingerprint": "8dfe562f3c21c1d82415a40ce249676208997221",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"payload_hash": "6496d4434b10a47927f571cea653ed6d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8911,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd6\u0013\ufffd\ufffd\u0019\ufffd\u025a\u0010\u0002A\ufffd\u0005\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffd\u0012L Fr!\u0003\ufffd\u0018\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffd\u0019oB\ufffdgt\ufffd]\u0000\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd6\u0013\ufffd\ufffd\u0019\ufffd\u025a\u0010\u0002A\ufffd\u0005\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffd\u0012L Fr!\u0003\ufffd\u0018\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffd\u0019oB\ufffdgt\ufffd]\u0000\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0002;\ufffd\ufffd\ufffd\ufffdy\ufffds\ufffdg\u00110Bxl\ufffd5\ufffdf\ufffd\ufffdU\ufffd\ufffd\u021c\ufffd\t\ufffd,\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd6\u0013\ufffd\ufffd\u0019\ufffd\u025a\u0010\u0002A\ufffd\u0005\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffd\u0012L Fr!\u0003\ufffd\u0018\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffd\u0019oB\ufffdgt\ufffd]\u0000\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c7b17b3423d3492cd3f09c510a5116d1ec2705d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd6\u0013\ufffd\ufffd\u0019\ufffd\u025a\u0010\u0002A\ufffd\u0005\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffd\u0012L Fr!\u0003\ufffd\u0018\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffd\u0019oB\ufffdgt\ufffd]\u0000\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u025aA\ufffd\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffdL Fr!\ufffd\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffdoB\ufffdgt\ufffd]\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8911,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd6\u0013\ufffd\ufffd\u0019\ufffd\u025a\u0010\u0002A\ufffd\u0005\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffd\u0012L Fr!\u0003\ufffd\u0018\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffd\u0019oB\ufffdgt\ufffd]\u0000\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u025aA\ufffd\ufffde\ufffd1HQuxBp\ufffdD\ufffdD$\ufffdL Fr!\ufffd\ufffd\ufffd\ufffd\ufffdqy\ufffdQ|\ufffd\ufffd\u02e6\ufffd*\ufffdoB\ufffdgt\ufffd]\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.86,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 de8c366fbb06bedc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �I� =N`� �C�FD�x�j��x6�2t, F3 j��Mʏ�I ڒ�P�h����#8���E�=Ϸ m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �I� =N`�
�C�FD�x�j��x6�2t, F3 j��Mʏ�I ڒ�P�h����#8���E�=Ϸ
m
62.3.50.33
�
Requête brute (extrait)
� �I� =N`� �C�FD�x�j��x6�2t, F3 j��Mʏ�I ڒ�P�h����#8���E�=Ϸ m 62.3.50.33 � # * ( + - 3����A)A�zuQ� '�$�Y�cV)�K_c�����sx�{
Meta JSON brut
{
"tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"bytes_in": 1481,
"payload_entropy": 7.736942573978227,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f149028f98d1d514207e7d49df030f584b5c0100",
"event_fingerprint": "5dd477c4684d961d3afdd9488f07044a8b2cf7e7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"payload_hash": "a4de1c9c0d43d96ea990c5c278c687b1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003I\ufffd\u000b=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\b\ufffdj\ufffd\ufffdx\u001a\u00186\u0011\ufffd2t,\u0000F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\u0016\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\u0018\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003I\ufffd\u000b=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\b\ufffdj\ufffd\ufffdx\u001a\u00186\u0011\ufffd2t,\u0000F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\u0016\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\u0018\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdA)A\ufffdzuQ\ufffd\f'\ufffd$\ufffdY\ufffd\u001bcV)\ufffdK_\u0015c\u0003\ufffd\ufffd\ufffd\ufffd\ufffdsx\ufffd{",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003I\ufffd\u000b=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\b\ufffdj\ufffd\ufffdx\u001a\u00186\u0011\ufffd2t,\u0000F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\u0016\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\u0018\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8058aa5debdbdda2474baad1f33540080a9d95b8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003I\ufffd\u000b=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\b\ufffdj\ufffd\ufffdx\u001a\u00186\u0011\ufffd2t,\u0000F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\u0016\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\u0018\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdI\ufffd=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\ufffdj\ufffd\ufffdx6\ufffd2t,F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003I\ufffd\u000b=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\b\ufffdj\ufffd\ufffdx\u001a\u00186\u0011\ufffd2t,\u0000F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\u0016\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\u0018\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdI\ufffd=N`\ufffd\r\ufffdC\ufffdFD\ufffdx\ufffdj\ufffd\ufffdx6\ufffd2t,F3 j\ufffd\ufffdM\u028f\ufffdI \u0692\ufffdP\ufffdh\ufffd\ufffd\ufffd\ufffd#8\ufffd\ufffd\ufffdE\ufffd=\u03f7\n\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 de8c366fbb06bedc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� � i������ϤQ*�F�(a?�8���,�軇�v i�r_���J����[?Q�.����M���y}�2 m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � i������ϤQ*�F�(a?�8���,�軇�v i�r_���J����[?Q�.����M���y}�2
m
62.3.50.33
�
Requête brute (extrait)
� � i������ϤQ*�F�(a?�8���,�軇�v i�r_���J����[?Q�.����M���y}�2 m 62.3.50.33 � # * ( + - 3����;�Ũ��Bka+��q� �3Y " � ��";
Meta JSON brut
{
"tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"bytes_in": 1481,
"payload_entropy": 7.727845629066832,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f149028f98d1d514207e7d49df030f584b5c0100",
"event_fingerprint": "5dd477c4684d961d3afdd9488f07044a8b2cf7e7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"payload_hash": "b10317bd4eab056755c0fe9722a6a18c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\u0019\ufffd\ufffd\ufffd\u0006,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\u0001\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\u0019\ufffd\ufffd\ufffd\u0006,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\u0001\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd;\ufffd\u0168\ufffd\u0002\ufffdBka+\ufffd\ufffd\u0018q\ufffd \u001a\ufffd\u0017\u00073Y\u0019\u001d\"\u0000\ufffd\u000b\ufffd\ufffd\";",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\u0019\ufffd\ufffd\ufffd\u0006,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\u0001\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52948c791fbe7dea39b84aae1170110c2268c411",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\u0019\ufffd\ufffd\ufffd\u0006,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\u0001\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\ufffd\ufffd\ufffd,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\u0019\ufffd\ufffd\ufffd\u0006,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\u0001\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\u0017\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e4Q*\ufffdF\ufffd(a?\ufffd8\ufffd\ufffd\ufffd,\ufffd\u8ec7\ufffdv i\ufffdr_\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd[?Q\ufffd.\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdy}\ufffd2\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8911 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8911 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 3947c3d16bc8cd21 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8911
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �) @V�gp�_�� ��8wο - 6�ܑx�Xl �] ��gK��1< U� �ͼ%p�����Ӹ� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �) @V�gp�_�� ��8wο
- 6�ܑx�Xl �] ��gK��1< U�
�ͼ%p�����Ӹ� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� �) @V�gp�_�� ��8wο - 6�ܑx�Xl �] ��gK��1< U� �ͼ%p�����Ӹ� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 1695,
"payload_entropy": 7.595042734313505,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8911,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "12ba9544a2254c7126fa4ede5ae54fc26eb02322",
"event_fingerprint": "bc893f6655282daf1da64d72815da2a767278270",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"payload_hash": "c9537c3120594ad906a09aba24ce1fbc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8911,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003)\u000b@V\ufffdg\u0017p\ufffd_\ufffd\ufffd \b\ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\u0019\ufffdXl \ufffd]\t\ufffd\ufffd\u0007gK\ufffd\ufffd1<\u0000U\u000f\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u04f8\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003)\u000b@V\ufffdg\u0017p\ufffd_\ufffd\ufffd \b\ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\u0019\ufffdXl \ufffd]\t\ufffd\ufffd\u0007gK\ufffd\ufffd1<\u0000U\u000f\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u04f8\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003)\u000b@V\ufffdg\u0017p\ufffd_\ufffd\ufffd \b\ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\u0019\ufffdXl \ufffd]\t\ufffd\ufffd\u0007gK\ufffd\ufffd1<\u0000U\u000f\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u04f8\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a0111a1a0674ea5304d991fd681786f213bd5ac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003)\u000b@V\ufffdg\u0017p\ufffd_\ufffd\ufffd \b\ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\u0019\ufffdXl \ufffd]\t\ufffd\ufffd\u0007gK\ufffd\ufffd1<\u0000U\u000f\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u04f8\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd)@V\ufffdgp\ufffd_\ufffd\ufffd \ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\ufffdXl \ufffd]\t\ufffd\ufffdgK\ufffd\ufffd1<U\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\ufffd\ufffd\u04f8\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8911,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003)\u000b@V\ufffdg\u0017p\ufffd_\ufffd\ufffd \b\ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\u0019\ufffdXl \ufffd]\t\ufffd\ufffd\u0007gK\ufffd\ufffd1<\u0000U\u000f\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u04f8\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd)@V\ufffdgp\ufffd_\ufffd\ufffd \ufffd\ufffd8w\u03bf\r- 6\ufffd\u0711x\ufffdXl \ufffd]\t\ufffd\ufffdgK\ufffd\ufffd1<U\ufffd\r\ufffd\u037c%p\ufffd\ufffd\ufffd\ufffd\ufffd\u04f8\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.89,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 3947c3d16bc8cd21 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �G��-J�p�lRƵ�� �D[ � ,J����]�� �� t7旘QѿE�J��D �/�+LkI ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �G��-J�p�lRƵ��
�D[
�
,J����]�� �� t7旘QѿE�J��D �/�+LkI ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� �G��-J�p�lRƵ�� �D[ � ,J����]�� �� t7旘QѿE�J��D �/�+LkI ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 1695,
"payload_entropy": 7.604821944105733,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89d28a04b046802a1562cace25fc16f6f959d70",
"event_fingerprint": "56627692a2b97ba2fddd34dd4a17bcb5ca51467a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"payload_hash": "61b63e488d247eb4c71fcea6ec175a01",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003G\ufffd\ufffd-J\ufffdp\u0019\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\u0019\ufffd\ufffd \ufffd\ufffd\u001et7\u65d8Q\u047fE\ufffd\u0005J\u000e\u0005\ufffd\ufffdD\f\ufffd\u0012\u0013\/\u0003\ufffd+LkI\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003G\ufffd\ufffd-J\ufffdp\u0019\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\u0019\ufffd\ufffd \ufffd\ufffd\u001et7\u65d8Q\u047fE\ufffd\u0005J\u000e\u0005\ufffd\ufffdD\f\ufffd\u0012\u0013\/\u0003\ufffd+LkI\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003G\ufffd\ufffd-J\ufffdp\u0019\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\u0019\ufffd\ufffd \ufffd\ufffd\u001et7\u65d8Q\u047fE\ufffd\u0005J\u000e\u0005\ufffd\ufffdD\f\ufffd\u0012\u0013\/\u0003\ufffd+LkI\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af0bb82881a2741e7e6b1f51c5e299183a43daa5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003G\ufffd\ufffd-J\ufffdp\u0019\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\u0019\ufffd\ufffd \ufffd\ufffd\u001et7\u65d8Q\u047fE\ufffd\u0005J\u000e\u0005\ufffd\ufffdD\f\ufffd\u0012\u0013\/\u0003\ufffd+LkI\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdG\ufffd\ufffd-J\ufffdp\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd \ufffd\ufffdt7\u65d8Q\u047fE\ufffdJ\ufffd\ufffdD\ufffd\/\ufffd+LkI\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003G\ufffd\ufffd-J\ufffdp\u0019\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\u0019\ufffd\ufffd \ufffd\ufffd\u001et7\u65d8Q\u047fE\ufffd\u0005J\u000e\u0005\ufffd\ufffdD\f\ufffd\u0012\u0013\/\u0003\ufffd+LkI\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdG\ufffd\ufffd-J\ufffdp\ufffdlR\u01b5\ufffd\ufffd\r\ufffdD[\r\ufffd\r,J\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd \ufffd\ufffdt7\u65d8Q\u047fE\ufffdJ\ufffd\ufffdD\ufffd\/\ufffd+LkI\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.88,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8562 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8562 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 3947c3d16bc8cd21 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8562
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �ߚ��>����t�iz��v-� yۑ��S�o$� iϦ���wvw }��/�~A���eV�1� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ߚ��>����t�iz��v-� yۑ��S�o$� iϦ���wvw
}��/�~A���eV�1� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� �ߚ��>����t�iz��v-� yۑ��S�o$� iϦ���wvw }��/�~A���eV�1� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 1695,
"payload_entropy": 7.576948051889663,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8562,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89d28a04b046802a1562cace25fc16f6f959d70",
"event_fingerprint": "56627692a2b97ba2fddd34dd4a17bcb5ca51467a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"payload_hash": "44f4403cbb36998199fcd7190ed2e20a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8562,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u07da\ufffd\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\u0002\ufffd\ufffdS\ufffdo$\ufffd\u0002 \u001ci\u0005\u03e6\ufffd\ufffd\ufffd\u0011\u000ewvw\r}\ufffd\ufffd\/\u001a\ufffd~A\ufffd\ufffd\ufffdeV\u0012\ufffd1\u0014\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u07da\ufffd\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\u0002\ufffd\ufffdS\ufffdo$\ufffd\u0002 \u001ci\u0005\u03e6\ufffd\ufffd\ufffd\u0011\u000ewvw\r}\ufffd\ufffd\/\u001a\ufffd~A\ufffd\ufffd\ufffdeV\u0012\ufffd1\u0014\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u07da\ufffd\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\u0002\ufffd\ufffdS\ufffdo$\ufffd\u0002 \u001ci\u0005\u03e6\ufffd\ufffd\ufffd\u0011\u000ewvw\r}\ufffd\ufffd\/\u001a\ufffd~A\ufffd\ufffd\ufffdeV\u0012\ufffd1\u0014\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3dbd4cb6940037eba0d310bcadfc6e5f1275e98e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u07da\ufffd\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\u0002\ufffd\ufffdS\ufffdo$\ufffd\u0002 \u001ci\u0005\u03e6\ufffd\ufffd\ufffd\u0011\u000ewvw\r}\ufffd\ufffd\/\u001a\ufffd~A\ufffd\ufffd\ufffdeV\u0012\ufffd1\u0014\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u07da\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\ufffd\ufffdS\ufffdo$\ufffd i\u03e6\ufffd\ufffd\ufffdwvw\r}\ufffd\ufffd\/\ufffd~A\ufffd\ufffd\ufffdeV\ufffd1\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8562,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u07da\ufffd\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\u0002\ufffd\ufffdS\ufffdo$\ufffd\u0002 \u001ci\u0005\u03e6\ufffd\ufffd\ufffd\u0011\u000ewvw\r}\ufffd\ufffd\/\u001a\ufffd~A\ufffd\ufffd\ufffdeV\u0012\ufffd1\u0014\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 8562,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8562 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u07da\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffdt\ufffdiz\ufffd\ufffdv-\ufffd y\u06d1\ufffd\ufffdS\ufffdo$\ufffd i\u03e6\ufffd\ufffd\ufffdwvw\r}\ufffd\ufffd\/\ufffd~A\ufffd\ufffd\ufffdeV\ufffd1\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "8562 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8562"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.87,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8911 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:8911 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
8911
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z VM�5 �2�5.�{�ߩ0�_x�wv,`�d�KX ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z VM�5
�2�5.�{�ߩ0�_x�wv,`�d�KX ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z VM�5 �2�5.�{�ߩ0�_x�wv,`�d�KX ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.341485341271915,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 8911,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "12ba9544a2254c7126fa4ede5ae54fc26eb02322",
"event_fingerprint": "6803dc322073a87a37c4a773a5a7ec85df541732",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "aa36fd9eea1036a1c97216480357cc6c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 8911,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0018M\ufffd5\n\u000e\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\u0011\ufffdwv,`\ufffdd\ufffd\u0003KX\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0018M\ufffd5\n\u000e\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\u0011\ufffdwv,`\ufffdd\ufffd\u0003KX\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0018M\ufffd5\n\u000e\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\u0011\ufffdwv,`\ufffdd\ufffd\u0003KX\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58be8011752a713b7d554ba97c9e2c5ab68ce623",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0018M\ufffd5\n\u000e\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\u0011\ufffdwv,`\ufffdd\ufffd\u0003KX\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZVM\ufffd5\n\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\ufffdwv,`\ufffdd\ufffdKX\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (91 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8911,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0018M\ufffd5\n\u000e\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\u0011\ufffdwv,`\ufffdd\ufffd\u0003KX\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 8911,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8911 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVM\ufffd5\n\ufffd2\ufffd5.\ufffd{\ufffd\u07e90\ufffd_x\ufffdwv,`\ufffdd\ufffdKX\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "8911 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
8104,
8343,
8562,
8637,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.83,
"multi_protocol_correlation": true,
"multi_protocol_count": 91,
"multi_protocol_sample": [
"activemq-console",
"clickhouse-http",
"consul",
"ftp-proxy",
"hdfs-namenode",
"http",
"http-alt-8004",
"http-alt-8008"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 29,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|