|
|
TCP |
8500 · CONSUL
|
consul
|
consul probe
consul probe · via CONSUL:8500 · (sonde / probe)
|
Élevée
|
Faible · 36
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL
WAF
—
Recommandation
Surveiller
Tags
consul_emulated
consul_payload
consul_probe
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8500
Chemin / cible
—
Service
CONSUL
Payload
GET / HTTP/1.1 Host: 62.3.50.33:8500 Accept: */* User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 6 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8500
Accept: */*
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8500 Accept: */* User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74",
"emulator_response_len": 138,
"bytes_in": 173,
"payload_entropy": 5.4162834525799735,
"port_category": "registered",
"org": "Google LLC",
"service": "consul",
"app_proto": "consul",
"asn": 396982,
"country": "US",
"dst_port": 8500,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 36,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "af9594ea6f43e1773816eda1794f59876845647a",
"event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 36,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "consul",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6c2405c64fdfd40f5daea56f0f06dbe",
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8500,
"service": "consul",
"service_name": "consul",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like ",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "445763ebc5b26f87d0fb45ad5b07e9559bfe8a9d",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"port": 8500,
"service": "consul",
"service_label_fr": "CONSUL"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)",
"target_port_label": "8500 \u00b7 CONSUL",
"emulator_service": "consul",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 36\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 36,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "consul",
"service_label_fr": "CONSUL",
"dst_port": 8500,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"port": 8500,
"service": "consul",
"service_label_fr": "CONSUL"
},
"attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "8500 \u00b7 CONSUL",
"emulator_service": "consul",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul",
"service_banner": "honeypot-consul",
"service_os": "linux",
"dst_port": "8500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"backup-scan-probe",
"consul",
"github-webhook",
"port:9034",
"port:9035",
"port:9041",
"port:9045",
"port:9048"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_emulated",
"consul_payload",
"consul_probe",
"http_get_probe",
"mozi_pattern",
"net_consul_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
9066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9066
Chemin / cible
—
Service
TLS
Payload
S O ?G���,��`~� ��{�Ֆ�w����<=�o�n ( f e d c b a `
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
S O ?G���,��`~� ��{�Ֆ�w����<=�o�n (
f e d c b a `
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 88,
"payload_entropy": 4.71356415999113,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 23,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c414f25007bf5ee3b7b826af0fd3a9ec6cb7f119",
"event_fingerprint": "3b23bef50a571bda8e34063b19249c45d52ed083",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "80ab07029d5f302cd55bfd003a3a37f1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d82e65d73275d3f594fd2bb356a7d43fb612f762",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"port": 9066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`",
"attack_vector": "port scan syn \u00b7 via TLS:9066 \u00b7 (reconnaissance)",
"target_port_label": "9066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (98 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"port": 9066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9066 \u00b7 (reconnaissance)",
"evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`",
"target_port_label": "9066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911,
8990
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 98,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9066
|
—
|
Scan de ports
port scan syn · port 9066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9066
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b",
"event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9066,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1481091d643763c885c96a41323c210a216c6ca",
"protocol_details": {
"port": 9066
},
"attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)",
"target_port_label": "9066",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (98 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9066
},
"attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9066",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 26,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 98,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 16ee84a07b55074c
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9066
Chemin / cible
—
Service
TLS
Payload
i eU ��random1random2random3random4 / 9 � 0 , *
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
i eU ��random1random2random3random4 /
9 � 0
, *
Meta JSON brut
{
"tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 110,
"payload_entropy": 4.269606220838881,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8660a811f6c4f79f753340b76611d09bac9d725b",
"event_fingerprint": "d20820d6789ab2c8cb61ae4f32349b9eeda562f9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "16ee84a07b55074cb2751329bf1c8811",
"payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "011b865e5f91ae5e1836c88110724dcb",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,47-10-19-57-4-255,13,,",
"tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb",
"tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6a59a83ebba21127b251e534095b9235b299f65",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"attack_vector": "port scan syn \u00b7 via TLS:9066 \u00b7 (reconnaissance)",
"target_port_label": "9066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (98 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9066 \u00b7 (reconnaissance)",
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"target_port_label": "9066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 26,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 98,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� � �;�O��$���['��P��x '��� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �;�O��$���['��P��x '��� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� � �;�O��$���['��P��x '��� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.837173640641026,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "6cf35cc7a392041a6ad4ded2702642caec33d94d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "c3d93993569de198eabc968448de879d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001f\ufffd;\ufffdO\u001a\ufffd\u000e\ufffd\u001b$\ufffd\ufffd\ufffd[\u0017'\ufffd\b\ufffdP\ufffd\u0005\ufffdx\f'\u0018\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001f\ufffd;\ufffdO\u001a\ufffd\u000e\ufffd\u001b$\ufffd\ufffd\ufffd[\u0017'\ufffd\b\ufffdP\ufffd\u0005\ufffdx\f'\u0018\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001f\ufffd;\ufffdO\u001a\ufffd\u000e\ufffd\u001b$\ufffd\ufffd\ufffd[\u0017'\ufffd\b\ufffdP\ufffd\u0005\ufffdx\f'\u0018\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a18eb88dfd49bcc6c9750aad5794cdc50a34a7e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001f\ufffd;\ufffdO\u001a\ufffd\u000e\ufffd\u001b$\ufffd\ufffd\ufffd[\u0017'\ufffd\b\ufffdP\ufffd\u0005\ufffdx\f'\u0018\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffdO\ufffd\ufffd$\ufffd\ufffd\ufffd['\ufffd\ufffdP\ufffd\ufffdx'\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\u001f\ufffd;\ufffdO\u001a\ufffd\u000e\ufffd\u001b$\ufffd\ufffd\ufffd[\u0017'\ufffd\b\ufffdP\ufffd\u0005\ufffdx\f'\u0018\ufffd\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffdO\ufffd\ufffd$\ufffd\ufffd\ufffd['\ufffd\ufffdP\ufffd\ufffdx'\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.8,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 3947c3d16bc8cd21 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �ª>�Q�k���$ '����\��M �G����d�n� T�vǼVI�L���< �q��W������Ԟ��N[ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ª>�Q�k���$ '����\��M �G����d�n� T�vǼVI�L���< �q��W������Ԟ��N[ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� �ª>�Q�k���$ '����\��M �G����d�n� T�vǼVI�L���< �q��W������Ԟ��N[ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 1695,
"payload_entropy": 7.61058715753848,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "6c3362856d82c55afda9a56240ad8e9f8a05d865",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"payload_hash": "6a0c87862261170abf0adac878bfe021",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\f\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd \u0012T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\u001e\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\f\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd \u0012T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\u001e\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\f\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd \u0012T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\u001e\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e10d6514dac38a18932a8a9e86e4e3416c28689f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\f\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd \u0012T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\u001e\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\f\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd \u0012T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\u001e\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u00aa>\ufffdQ\ufffdk\ufffd\ufffd\ufffd$ '\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffdM\ufffdG\ufffd\ufffd\ufffd\ufffdd\ufffdn\ufffd T\ufffdv\u01fcVI\ufffdL\ufffd\ufffd\ufffd<\ufffdq\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u051e\ufffd\ufffdN[\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z Va��RO#�$O5�s���� � W�v=�Rgc� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z Va��RO#�$O5�s����
� W�v=�Rgc� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z Va��RO#�$O5�s���� � W�v=�Rgc� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.319571356197021,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "cb5584089376b1efdde3ce1e702c57fee1886f29",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "b749fbf9fd34aacb4321437d01857fcc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003a\ufffd\u0011\ufffdRO#\ufffd$O5\ufffd\u0011s\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001cW\u0018\ufffdv\u0015=\ufffdRgc\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003a\ufffd\u0011\ufffdRO#\ufffd$O5\ufffd\u0011s\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001cW\u0018\ufffdv\u0015=\ufffdRgc\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003a\ufffd\u0011\ufffdRO#\ufffd$O5\ufffd\u0011s\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001cW\u0018\ufffdv\u0015=\ufffdRgc\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f006e44fd699565b2cd892a9bdc9edcb5e30fac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003a\ufffd\u0011\ufffdRO#\ufffd$O5\ufffd\u0011s\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001cW\u0018\ufffdv\u0015=\ufffdRgc\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZVa\ufffd\ufffdRO#\ufffd$O5\ufffds\ufffd\ufffd\ufffd\ufffd\r\ufffdW\ufffdv=\ufffdRgc\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003a\ufffd\u0011\ufffdRO#\ufffd$O5\ufffd\u0011s\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001cW\u0018\ufffdv\u0015=\ufffdRgc\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVa\ufffd\ufffdRO#\ufffd$O5\ufffds\ufffd\ufffd\ufffd\ufffd\r\ufffdW\ufffdv=\ufffdRgc\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.01,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �z�T�l�NpL�V7^)%ڗ����)����7/ F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �z�T�l�NpL�V7^)%ڗ����)����7/ F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �z�T�l�NpL�V7^)%ڗ����)����7/ F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.8755830026443405,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "51f61fd9df0401c98f088034994e38d5ec0bc40a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "448e3d234450782be62f8f361dfe804b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002z\ufffdT\ufffdl\u001a\u001a\ufffdNpL\ufffdV\u00067^)%\u0697\u0018\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002z\ufffdT\ufffdl\u001a\u001a\ufffdNpL\ufffdV\u00067^)%\u0697\u0018\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002z\ufffdT\ufffdl\u001a\u001a\ufffdNpL\ufffdV\u00067^)%\u0697\u0018\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a5e0c953b7cf2ab0453cadae2d81827a394654d4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002z\ufffdT\ufffdl\u001a\u001a\ufffdNpL\ufffdV\u00067^)%\u0697\u0018\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdz\ufffdT\ufffdl\ufffdNpL\ufffdV7^)%\u0697\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002z\ufffdT\ufffdl\u001a\u001a\ufffdNpL\ufffdV\u00067^)%\u0697\u0018\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdz\ufffdT\ufffdl\ufffdNpL\ufffdV7^)%\u0697\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd7\/F\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �� -[���z� �KDy����F�. ��D�P{o F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� -[���z� �KDy����F�. ��D�P{o F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �� -[���z� �KDy����F�. ��D�P{o F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.822514679914038,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "864d999a46bc2eb713b6f4005b98243c26d28625",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "b85f7eb03e093f26f3336906f08b7515",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\u001e-[\ufffd\u000e\ufffd\ufffdz\ufffd\f\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\u001e\ufffd\ufffdD\ufffdP{o\u0001\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\u001e-[\ufffd\u000e\ufffd\ufffdz\ufffd\f\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\u001e\ufffd\ufffdD\ufffdP{o\u0001\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\u001e-[\ufffd\u000e\ufffd\ufffdz\ufffd\f\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\u001e\ufffd\ufffdD\ufffdP{o\u0001\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e838c8de84a10a35c2f14422a4f8a3b2a6f228b7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\u001e-[\ufffd\u000e\ufffd\ufffdz\ufffd\f\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\u001e\ufffd\ufffdD\ufffdP{o\u0001\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd-[\ufffd\ufffd\ufffdz\ufffd\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\ufffd\ufffdD\ufffdP{oF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\u001e-[\ufffd\u000e\ufffd\ufffdz\ufffd\f\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\u001e\ufffd\ufffdD\ufffdP{o\u0001\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd-[\ufffd\ufffd\ufffdz\ufffd\ufffdKDy\ufffd\ufffd\ufffd\ufffdF\ufffd.\ufffd\ufffdD\ufffdP{oF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z Vn`@�$J����� �s��2a�� �v'G� �� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z Vn`@�$J����� �s��2a�� �v'G� �� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z Vn`@�$J����� �s��2a�� �v'G� �� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.329380925102435,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "cb5584089376b1efdde3ce1e702c57fee1886f29",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "6f424c532582cb753849b68f8a4d09d0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003n`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2\u0001a\ufffd\ufffd\u001d\ufffdv\u0015'G\ufffd\u001f\ufffd\ufffd\u001e\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003n`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2\u0001a\ufffd\ufffd\u001d\ufffdv\u0015'G\ufffd\u001f\ufffd\ufffd\u001e\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003n`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2\u0001a\ufffd\ufffd\u001d\ufffdv\u0015'G\ufffd\u001f\ufffd\ufffd\u001e\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cacc7090b684d0120dc2129da03beb53a07d3fbd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003n`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2\u0001a\ufffd\ufffd\u001d\ufffdv\u0015'G\ufffd\u001f\ufffd\ufffd\u001e\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZVn`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2a\ufffd\ufffd\ufffdv'G\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003n`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2\u0001a\ufffd\ufffd\u001d\ufffdv\u0015'G\ufffd\u001f\ufffd\ufffd\u001e\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVn`@\ufffd$J\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffds\ufffd\ufffd2a\ufffd\ufffd\ufffdv'G\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f75ed71469bb3c2c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �jm�z�Hk ۥ�Im;p����ܑf�&$�p�� ��H' ۼ�LmR"���ߑ}1)$�r��L�H> f 62.3.50.33 # 0
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �jm�z�Hk ۥ�Im;p����ܑf�&$�p�� ��H' ۼ�LmR"���ߑ}1)$�r��L�H>
f
62.3.50.33 #
0
Requête brute (extrait)
� �jm�z�Hk ۥ�Im;p����ܑf�&$�p�� ��H' ۼ�LmR"���ߑ}1)$�r��L�H> f 62.3.50.33 # 0 . �c� 3�� t�ŵ���5����jΰg�MqZ;-N�T&|�C�����
Meta JSON brut
{
"tls_ja3_hash": "f75ed71469bb3c2c20879e1bbf978609",
"tls_sni": "62.3.50.33",
"bytes_in": 1474,
"payload_entropy": 7.720369440116813,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dcbdcf902f2fd53bd84b80eede9bb5ca534a0032",
"event_fingerprint": "663b5d6e519edede14273ae58bab4d23597f027c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f75ed71469bb3c2c20879e1bbf978609",
"payload_hash": "fc9b954ed475895474c6f518c9e3b6e5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 t\ufffd\u0175\ufffd\ufffd\ufffd5\ufffd\u0005\ufffd\ufffd\ufffdj\u03b0g\u001b\ufffdMqZ;-N\u0003\ufffdT&|\ufffdC\u0011\ufffd\u0004\ufffd\u001a\ufffd\u0006\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8860e235c8fa7743eaefd2baae36b91490d01ee5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"tls_ja3": "f75ed71469bb3c2c20879e1bbf978609",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdjm\ufffdz\ufffdHk\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH'\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\ufffdr\ufffd\ufffdL\ufffdH>\nf\r\n62.3.50.33#\r0",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"tls_ja3": "f75ed71469bb3c2c20879e1bbf978609",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdjm\ufffdz\ufffdHk\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH'\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\ufffdr\ufffd\ufffdL\ufffdH>\nf\r\n62.3.50.33#\r0",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.02,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 de8c366fbb06bedc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �NeI���9�e�Y��G�%u��������� �zr&� O�#��/��[�c�dyz1�C�d� m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �NeI���9�e�Y��G�%u��������� �zr&� O�#��/��[�c�dyz1�C�d�
m
62.3.50.33
�
Requête brute (extrait)
� �NeI���9�e�Y��G�%u��������� �zr&� O�#��/��[�c�dyz1�C�d� m 62.3.50.33 � # * ( + - 3�����s �7���G4����L�;?�u;�:����
Meta JSON brut
{
"tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"bytes_in": 1481,
"payload_entropy": 7.747158110950499,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dcbdcf902f2fd53bd84b80eede9bb5ca534a0032",
"event_fingerprint": "0f01d7fae2ab8397cf264f8a00953c0d7362dfa6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"payload_hash": "707d90c955044ea746cb24f7b7dfa196",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003N\u0014eI\ufffd\ufffd\ufffd9\ufffde\ufffd\u0003Y\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd \ufffdzr&\ufffd\t\u0000O\ufffd#\ufffd\u0014\ufffd\/\u0004\ufffd\ufffd[\ufffd\u0016c\ufffddyz1\u0010\ufffdC\ufffdd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003N\u0014eI\ufffd\ufffd\ufffd9\ufffde\ufffd\u0003Y\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd \ufffdzr&\ufffd\t\u0000O\ufffd#\ufffd\u0014\ufffd\/\u0004\ufffd\ufffd[\ufffd\u0016c\ufffddyz1\u0010\ufffdC\ufffdd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffds\u001d\ufffd7\ufffd\ufffd\ufffdG4\u000e\ufffd\ufffd\ufffd\ufffdL\ufffd;?\ufffdu;\u0014\ufffd:\u0001\ufffd\u0002\ufffd\ufffd\ufffd\u0014",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003N\u0014eI\ufffd\ufffd\ufffd9\ufffde\ufffd\u0003Y\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd \ufffdzr&\ufffd\t\u0000O\ufffd#\ufffd\u0014\ufffd\/\u0004\ufffd\ufffd[\ufffd\u0016c\ufffddyz1\u0010\ufffdC\ufffdd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba9581e3ec45b05fd9d295e5636306477078c999",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003N\u0014eI\ufffd\ufffd\ufffd9\ufffde\ufffd\u0003Y\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd \ufffdzr&\ufffd\t\u0000O\ufffd#\ufffd\u0014\ufffd\/\u0004\ufffd\ufffd[\ufffd\u0016c\ufffddyz1\u0010\ufffdC\ufffdd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdNeI\ufffd\ufffd\ufffd9\ufffde\ufffdY\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdzr&\ufffd\tO\ufffd#\ufffd\ufffd\/\ufffd\ufffd[\ufffdc\ufffddyz1\ufffdC\ufffdd\ufffd\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003N\u0014eI\ufffd\ufffd\ufffd9\ufffde\ufffd\u0003Y\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd \ufffdzr&\ufffd\t\u0000O\ufffd#\ufffd\u0014\ufffd\/\u0004\ufffd\ufffd[\ufffd\u0016c\ufffddyz1\u0010\ufffdC\ufffdd\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdNeI\ufffd\ufffd\ufffd9\ufffde\ufffdY\ufffd\ufffdG\ufffd%u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdzr&\ufffd\tO\ufffd#\ufffd\ufffd\/\ufffd\ufffd[\ufffdc\ufffddyz1\ufffdC\ufffdd\ufffd\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.05,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 3947c3d16bc8cd21 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��#�tK$�grh8�����P�?S�lmQ� ��zo�/�� �*�I��Ug:��Ldz�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��#�tK$�grh8�����P�?S�lmQ� ��zo�/�� �*�I��Ug:��Ldz�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� ��#�tK$�grh8�����P�?S�lmQ� ��zo�/�� �*�I��Ug:��Ldz�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 1695,
"payload_entropy": 7.602051694863904,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "f269ab22a9d154ea321528e399e3c455b1f33153",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"payload_hash": "6e0a7b7f549f799ecb14021a4bc5c003",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd#\ufffdt\u0002K$\u001a\ue6f9\ufffdgrh8\ufffd\ufffd\u0005\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \u0001\ufffd\ufffdzo\ufffd\/\u0018\ufffd\ufffd\u000b\ufffd*\u0007\ufffd\u0012\u0012I\ufffd\ufffdUg:\ufffd\ufffdLd\u0011z\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd#\ufffdt\u0002K$\u001a\ue6f9\ufffdgrh8\ufffd\ufffd\u0005\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \u0001\ufffd\ufffdzo\ufffd\/\u0018\ufffd\ufffd\u000b\ufffd*\u0007\ufffd\u0012\u0012I\ufffd\ufffdUg:\ufffd\ufffdLd\u0011z\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd#\ufffdt\u0002K$\u001a\ue6f9\ufffdgrh8\ufffd\ufffd\u0005\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \u0001\ufffd\ufffdzo\ufffd\/\u0018\ufffd\ufffd\u000b\ufffd*\u0007\ufffd\u0012\u0012I\ufffd\ufffdUg:\ufffd\ufffdLd\u0011z\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "038e3f8d09441f5eebdc97a307a9e94dcb9e84a2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd#\ufffdt\u0002K$\u001a\ue6f9\ufffdgrh8\ufffd\ufffd\u0005\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \u0001\ufffd\ufffdzo\ufffd\/\u0018\ufffd\ufffd\u000b\ufffd*\u0007\ufffd\u0012\u0012I\ufffd\ufffdUg:\ufffd\ufffdLd\u0011z\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd#\ufffdtK$\ue6f9\ufffdgrh8\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \ufffd\ufffdzo\ufffd\/\ufffd\ufffd\ufffd*\ufffdI\ufffd\ufffdUg:\ufffd\ufffdLdz\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd#\ufffdt\u0002K$\u001a\ue6f9\ufffdgrh8\ufffd\ufffd\u0005\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \u0001\ufffd\ufffdzo\ufffd\/\u0018\ufffd\ufffd\u000b\ufffd*\u0007\ufffd\u0012\u0012I\ufffd\ufffdUg:\ufffd\ufffdLd\u0011z\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd#\ufffdtK$\ue6f9\ufffdgrh8\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd?S\ufffdlmQ\ufffd \ufffd\ufffdzo\ufffd\/\ufffd\ufffd\ufffd*\ufffdI\ufffd\ufffdUg:\ufffd\ufffdLdz\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1196e3b1fa255a44 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�y�Ho ۤ�Im:p����ܑe�&$�p�� ��H& ۻ�LmQ#���ߑ|2)$�r��M�H=�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�y�Ho ۤ�Im:p����ܑe�&$�p�� ��H& ۻ�LmQ#���ߑ|2)$�r��M�H=�
Requête brute (extrait)
~ zjm�y�Ho ۤ�Im:p����ܑe�&$�p�� ��H& ۻ�LmQ#���ߑ|2)$�r��M�H=� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.743298018885115,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "38b90d5b28ef22b0c26bce98f58f2bc35254d02b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1196e3b1fa255a444a88617c122e45a5",
"payload_hash": "318aceee27ebb2eb641358b89d3e541c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "883fb1cc6e40734d09e3d52a3738c741fed3e6bd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdy\ufffdHo\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH& \u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\ufffdr\ufffd\ufffdM\ufffdH=\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdy\ufffdH\u000fo\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffd\u0019p\ufffd\ufffd \ufffd\ufffdH& \u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\u0012\ufffdr\ufffd\ufffdM\ufffdH=\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdy\ufffdHo\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH& \u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\ufffdr\ufffd\ufffdM\ufffdH=\ufffd",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.2,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z V5�P ��^Q�C;�0���8��� nݝ�C5� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z V5�P ��^Q�C;�0���8��� nݝ�C5� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z V5�P ��^Q�C;�0���8��� nݝ�C5� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.343644705652882,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "4df46ffc604d0ce71078d7737909ec0ffaa2e640",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "260be349e595d5f7226664dbe61c7620",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00035\ufffdP\u001f\b\ufffd\ufffd^Q\ufffd\u0007C;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\u0012\ufffd\u000bn\u075d\ufffdC5\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00035\ufffdP\u001f\b\ufffd\ufffd^Q\ufffd\u0007C;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\u0012\ufffd\u000bn\u075d\ufffdC5\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00035\ufffdP\u001f\b\ufffd\ufffd^Q\ufffd\u0007C;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\u0012\ufffd\u000bn\u075d\ufffdC5\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b41696fb176a32f44e1dffc35645a49aab21288f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00035\ufffdP\u001f\b\ufffd\ufffd^Q\ufffd\u0007C;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\u0012\ufffd\u000bn\u075d\ufffdC5\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZV5\ufffdP\ufffd\ufffd^Q\ufffdC;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdn\u075d\ufffdC5\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00035\ufffdP\u001f\b\ufffd\ufffd^Q\ufffd\u0007C;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\u0012\ufffd\u000bn\u075d\ufffdC5\ufffd\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "ZV5\ufffdP\ufffd\ufffd^Q\ufffdC;\ufffd0\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdn\u075d\ufffdC5\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �)�D �� F�v�m���N�`(����p��� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �)�D �� F�v�m���N�`(����p��� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �)�D �� F�v�m���N�`(����p��� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.891325216942418,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "51f61fd9df0401c98f088034994e38d5ec0bc40a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "63d6cab039cc63dcc0d915972df099d8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002)\ufffdD\u000b\ufffd\ufffd\f\u0007F\ufffdv\ufffdm\ufffd\ufffd\u0004\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0010\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002)\ufffdD\u000b\ufffd\ufffd\f\u0007F\ufffdv\ufffdm\ufffd\ufffd\u0004\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0010\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002)\ufffdD\u000b\ufffd\ufffd\f\u0007F\ufffdv\ufffdm\ufffd\ufffd\u0004\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0010\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea99ac7164c3509ca35721e185729aad200ad611",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002)\ufffdD\u000b\ufffd\ufffd\f\u0007F\ufffdv\ufffdm\ufffd\ufffd\u0004\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0010\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd)\ufffdD\ufffd\ufffdF\ufffdv\ufffdm\ufffd\ufffd\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002)\ufffdD\u000b\ufffd\ufffd\f\u0007F\ufffdv\ufffdm\ufffd\ufffd\u0004\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0010\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd)\ufffdD\ufffd\ufffdF\ufffdv\ufffdm\ufffd\ufffd\ufffdN\ufffd`(\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.2,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��5`�+��7pQ��{ `k�A�y�7>EHѹ� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��5`�+��7pQ��{ `k�A�y�7>EHѹ� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��5`�+��7pQ��{ `k�A�y�7>EHѹ� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.848412216917692,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "14f8d817d41e077e98e28936d2e828e0d8fbe09a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "25f6a706a9ccfd45d957300bf84a6519",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{\u0018\u001a\u001c`k\ufffdA\ufffdy\ufffd7>\u0006EH\u000e\u0479\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{\u0018\u001a\u001c`k\ufffdA\ufffdy\ufffd7>\u0006EH\u000e\u0479\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{\u0018\u001a\u001c`k\ufffdA\ufffdy\ufffd7>\u0006EH\u000e\u0479\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7563274118df907ff0c0a254358ff05700f6cb1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{\u0018\u001a\u001c`k\ufffdA\ufffdy\ufffd7>\u0006EH\u000e\u0479\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{`k\ufffdA\ufffdy\ufffd7>EH\u0479\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{\u0018\u001a\u001c`k\ufffdA\ufffdy\ufffd7>\u0006EH\u000e\u0479\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd5`\ufffd+\ufffd\ufffd7pQ\ufffd\ufffd{`k\ufffdA\ufffdy\ufffd7>EH\u0479\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 4ae33de1ad939562 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�z�Hk ۥ�Im;p����ܑf�&$�p�� ��H' ۼ�LmR"���ߑ}1)$�r��L�H>�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�z�Hk ۥ�Im;p����ܑf�&$�p�� ��H' ۼ�LmR"���ߑ}1)$�r��L�H>�
Requête brute (extrait)
~ zjm�z�Hk ۥ�Im;p����ܑf�&$�p�� ��H' ۼ�LmR"���ߑ}1)$�r��L�H>� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.737643852418432,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "c1728e39d0facd90a68ddad554b7e63062791095",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4ae33de1ad93956213297c61748ec996",
"payload_hash": "394a88fa5810921206eb44e6e1bdbc9d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3114fa6f77381580c27304a05b30e1bdb34c6bd4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdz\ufffdHk\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH'\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\ufffdr\ufffd\ufffdL\ufffdH>\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdz\ufffdH\u0010k\u0000\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffd\u0018p\ufffd\ufffd \ufffd\ufffdH'\u001f\u0003\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\u0013\ufffdr\ufffd\ufffdL\ufffdH>\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdz\ufffdHk\u06e5\ufffdIm;p\ufffd\ufffd\ufffd\ufffd\u0711f\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH'\u06fc\ufffdLmR\"\ufffd\ufffd\ufffd\u07d1}1)$\ufffdr\ufffd\ufffdL\ufffdH>\ufffd",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �:�#�$�~6C�bjuѼ�����j��L+��2� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �:�#�$�~6C�bjuѼ�����j��L+��2� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �:�#�$�~6C�bjuѼ�����j��L+��2� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.8755830026443405,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "0677f8952607e6a71534425e70538a3a95089fcc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "9ee12138c6ce14308cc5089405945e65",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\u001b\ufffd\u001a\ufffdL+\ufffd\u0018\ufffd2\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\u001b\ufffd\u001a\ufffdL+\ufffd\u0018\ufffd2\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\u001b\ufffd\u001a\ufffdL+\ufffd\u0018\ufffd2\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae74b5dd9838f1663a2d3dc986facb11af7ab424",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\u001b\ufffd\u001a\ufffdL+\ufffd\u0018\ufffd2\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdL+\ufffd\ufffd2\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\u001b\ufffd\u001a\ufffdL+\ufffd\u0018\ufffd2\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd:\ufffd#\ufffd$\ufffd~6C\ufffdbju\u047c\ufffd\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdL+\ufffd\ufffd2\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 1.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z VY0��G|��>�mw Z�G ��d�4�Y���^ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z VY0��G|��>�mw Z�G ��d�4�Y���^ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z VY0��G|��>�mw Z�G ��d�4�Y���^ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.367417474486112,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "4df46ffc604d0ce71078d7737909ec0ffaa2e640",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "fb9b21739d114234efa34e3123308226",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003Y0\ufffd\ufffdG|\ufffd\u0015\ufffd>\ufffdmw\u001fZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\u0015\ufffd\ufffd\ufffd^\u0017\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003Y0\ufffd\ufffdG|\ufffd\u0015\ufffd>\ufffdmw\u001fZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\u0015\ufffd\ufffd\ufffd^\u0017\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003Y0\ufffd\ufffdG|\ufffd\u0015\ufffd>\ufffdmw\u001fZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\u0015\ufffd\ufffd\ufffd^\u0017\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ae87bafe8687b81199a6fc6af019655b1886dd5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003Y0\ufffd\ufffdG|\ufffd\u0015\ufffd>\ufffdmw\u001fZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\u0015\ufffd\ufffd\ufffd^\u0017\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZVY0\ufffd\ufffdG|\ufffd\ufffd>\ufffdmwZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\ufffd\ufffd\ufffd^\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003Y0\ufffd\ufffdG|\ufffd\u0015\ufffd>\ufffdmw\u001fZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\u0015\ufffd\ufffd\ufffd^\u0017\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVY0\ufffd\ufffdG|\ufffd\ufffd>\ufffdmwZ\ufffdG \ufffd\ufffdd\ufffd4\ufffdY\ufffd\ufffd\ufffd^\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.25,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 11,
"payload_entropy": 2.2221915755066783,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 23,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "24c2354394f8d3b5c42cd598dad45f3b7ed1c267",
"event_fingerprint": "addfa34ca202551d3d1b2e80d040c1806fc6ce7c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "55b6c6b63391f7a244877208a3a6144c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "812419eb7b46062db335f0f25e79e39c1e996b21",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��V���r֭i�� u������#�.�`¾� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��V���r֭i�� u������#�.�`¾� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��V���r֭i�� u������#�.�`¾� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.835455608522555,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "7272ec20a6c6c93d6b8183acafc48dad4a4d71bb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "5204d792ce77eba1447ac37282e2ad3c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdV\ufffd\ufffd\ufffdr\u0001\u0011\u05adi\ufffd\ufffd\fu\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\u0003\u0010\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdV\ufffd\ufffd\ufffdr\u0001\u0011\u05adi\ufffd\ufffd\fu\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\u0003\u0010\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdV\ufffd\ufffd\ufffdr\u0001\u0011\u05adi\ufffd\ufffd\fu\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\u0003\u0010\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a9a5c90569499c6bcc14e803d4497caa1113ce20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdV\ufffd\ufffd\ufffdr\u0001\u0011\u05adi\ufffd\ufffd\fu\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\u0003\u0010\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdr\u05adi\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffdV\ufffd\ufffd\ufffdr\u0001\u0011\u05adi\ufffd\ufffd\fu\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\u0003\u0010\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdr\u05adi\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd.\ufffd`\u00be\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 28f30581990ff22f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �jm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H< f 62.3.50.33 # 0
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �jm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<
f
62.3.50.33 #
0
Requête brute (extrait)
� �jm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H< f 62.3.50.33 # 0 . �c� 3�� 1g�P�r�G�>�}� �<#5p/��=�`C��L@�6
Meta JSON brut
{
"tls_ja3_hash": "28f30581990ff22f98014b77004958c8",
"tls_sni": "62.3.50.33",
"bytes_in": 1474,
"payload_entropy": 7.762014087442233,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "db4a68bf33879902c6c5fd02ec7bdc383166f3e7",
"event_fingerprint": "b6a91379b77ae64a3d77df43b6240bb70ae9b9ca",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "28f30581990ff22f98014b77004958c8",
"payload_hash": "5228c7ae473112501f403cb2557faed7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 1g\ufffdP\ufffdr\ufffdG\ufffd>\ufffd}\ufffd\u0000\u000f\u001f\ufffd<#5p\/\ufffd\ufffd=\u0007\ufffd`C\u0011\ufffd\u0004\ufffdL@\ufffd\u001a6",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3970754d75662ecb6b0c571d1be436ccfc656e47",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"tls_ja3": "28f30581990ff22f98014b77004958c8",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\nf\r\n62.3.50.33#\r0",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"tls_ja3": "28f30581990ff22f98014b77004958c8",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\nf\r\n62.3.50.33#\r0",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 e53406bbb3118b0c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<�
Requête brute (extrait)
~ zjm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.739668570917472,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "b6844c0a6c6a67a45deba7fa00e9ff83625a5803",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "e53406bbb3118b0c8a662f6717ac159d",
"payload_hash": "608f3b393de9ce61f195c8abe38a1ad9",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff9e006c19d21d2482f97eee6eb20bad62a050e9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 de8c366fbb06bedc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� � �/� �j8��Y�#b�2v�|/�c���ї�T ;�[3ǘPL�f����A�JY���%S�*�# m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �/� �j8��Y�#b�2v�|/�c���ї�T ;�[3ǘPL�f����A�JY���%S�*�#
m
62.3.50.33
�
Requête brute (extrait)
� � �/� �j8��Y�#b�2v�|/�c���ї�T ;�[3ǘPL�f����A�JY���%S�*�# m 62.3.50.33 � # * ( + - 3�����{<^�F�)L`3�� U�P�Ub�H�r�u��
Meta JSON brut
{
"tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"bytes_in": 1481,
"payload_entropy": 7.72427363522352,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "db4a68bf33879902c6c5fd02ec7bdc383166f3e7",
"event_fingerprint": "15f9f834e51349eb3d8b271e86e5eae8b615e26c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"payload_hash": "05eaaa9a0c318cee9a82d99fa59cbb51",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001f\ufffd\/\ufffd\u001f\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\b\/\ufffdc\u0018\u0012\ufffd\ufffd\ufffd\u0457\ufffdT ;\u0014\ufffd[3\u01d8\u000fPL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\u0004\ufffd%S\ufffd*\ufffd#\u0014\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001f\ufffd\/\ufffd\u001f\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\b\/\ufffdc\u0018\u0012\ufffd\ufffd\ufffd\u0457\ufffdT ;\u0014\ufffd[3\u01d8\u000fPL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\u0004\ufffd%S\ufffd*\ufffd#\u0014\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd{<^\ufffdF\ufffd)L\u0019`3\ufffd\ufffd\tU\ufffd\u000fP\u0016\ufffdUb\u0002\ufffd\u0015\u0003H\ufffdr\ufffdu\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001f\ufffd\/\ufffd\u001f\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\b\/\ufffdc\u0018\u0012\ufffd\ufffd\ufffd\u0457\ufffdT ;\u0014\ufffd[3\u01d8\u000fPL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\u0004\ufffd%S\ufffd*\ufffd#\u0014\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "944f3eac1dc118f3777815d9d86eaf6154843738",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001f\ufffd\/\ufffd\u001f\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\b\/\ufffdc\u0018\u0012\ufffd\ufffd\ufffd\u0457\ufffdT ;\u0014\ufffd[3\u01d8\u000fPL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\u0004\ufffd%S\ufffd*\ufffd#\u0014\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\/\ufffd\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\/\ufffdc\ufffd\ufffd\ufffd\u0457\ufffdT ;\ufffd[3\u01d8PL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\ufffd%S\ufffd*\ufffd#\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001f\ufffd\/\ufffd\u001f\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\b\/\ufffdc\u0018\u0012\ufffd\ufffd\ufffd\u0457\ufffdT ;\u0014\ufffd[3\u01d8\u000fPL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\u0004\ufffd%S\ufffd*\ufffd#\u0014\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\/\ufffd\ufffdj8\ufffd\ufffdY\ufffd#b\ufffd2v\ufffd|\/\ufffdc\ufffd\ufffd\ufffd\u0457\ufffdT ;\ufffd[3\u01d8PL\ufffdf\ufffd\ufffd\ufffd\ufffdA\ufffdJY\ufffd\ufffd\ufffd%S\ufffd*\ufffd#\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.27,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��/u_E��WWx)���gh��n/ �Bel� �� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��/u_E��WWx)���gh��n/ �Bel� �� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��/u_E��WWx)���gh��n/ �Bel� �� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.816108132930677,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4bb4064c22e922d5888655f2fa843c42637380f0",
"event_fingerprint": "6cf35cc7a392041a6ad4ded2702642caec33d94d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "1f038d8a435aa2c09dbc052f5d28c393",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9048,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\/u_E\ufffd\ufffdWW\u001bx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\u0002\/\t\ufffdBe\u0005l\ufffd\u0000\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\/u_E\ufffd\ufffdWW\u001bx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\u0002\/\t\ufffdBe\u0005l\ufffd\u0000\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\/u_E\ufffd\ufffdWW\u001bx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\u0002\/\t\ufffdBe\u0005l\ufffd\u0000\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68fb8cf1495d28c41e69cfc20f19b7a183ecee2e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\/u_E\ufffd\ufffdWW\u001bx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\u0002\/\t\ufffdBe\u0005l\ufffd\u0000\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\/u_E\ufffd\ufffdWWx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\/\t\ufffdBel\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\/u_E\ufffd\ufffdWW\u001bx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\u0002\/\t\ufffdBe\u0005l\ufffd\u0000\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9048,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\/u_E\ufffd\ufffdWWx)\ufffd\ufffd\ufffdgh\ufffd\ufffdn\/\t\ufffdBel\ufffd\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9048 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
SNI TLS
62.3.50.33
Payload
� �a_�w OGv�n|}da1����p�:dZ/a'�ݙ � F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �a_�w
OGv�n|}da1����p�:dZ/a'�ݙ � F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �a_�w OGv�n|}da1����p�:dZ/a'�ݙ � F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 175,
"payload_entropy": 4.87335237678398,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ca4a14cd86faa96691ed35ed2fdc288b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "67625c3bd21c099689690498fb5b754e",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001a_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\f\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001a_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\f\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001a_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\f\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a71739da55460fda3301b26c85b54e9622ff8419",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001a_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\f\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffda_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001a_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\f\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffda_\ufffdw\rOGv\ufffdn|}da1\ufffd\ufffd\ufffd\ufffdp\ufffd:dZ\/a'\ufffd\u0759\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.02,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 de8c366fbb06bedc SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �qHB��a`T�� ��]}�&���v=���jL ��f K��P��ѕRa�9��~�ɇL�cΉg� m 62.3.50.33 �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �qHB��a`T�� ��]}�&���v=���jL ��f K��P��ѕRa�9��~�ɇL�cΉg�
m
62.3.50.33
�
Requête brute (extrait)
� �qHB��a`T�� ��]}�&���v=���jL ��f K��P��ѕRa�9��~�ɇL�cΉg� m 62.3.50.33 � # * ( + - 3�����P�)�P�ƭ<#�k��������v���� s�
Meta JSON brut
{
"tls_ja3_hash": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"bytes_in": 1481,
"payload_entropy": 7.744529362214905,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cc9967946468da8c3b227db17c93d494861a26eb",
"event_fingerprint": "fa78e6d089577296e8ef73ae18e38973be2a61cb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"payload_hash": "813cc61902646315ab86c24fb66eca94",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qHB\ufffd\u0014\ufffda`T\ufffd\ufffd\u0000\ufffd\ufffd\u001b]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\u0010\u001b\ufffd\u0006\ufffdjL \ufffd\ufffdf \u0004K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd\u00159\ufffd\ufffd~\u0014\ufffd\u0247L\ufffdc\u0389g\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qHB\ufffd\u0014\ufffda`T\ufffd\ufffd\u0000\ufffd\ufffd\u001b]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\u0010\u001b\ufffd\u0006\ufffdjL \ufffd\ufffdf \u0004K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd\u00159\ufffd\ufffd~\u0014\ufffd\u0247L\ufffdc\u0389g\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0010P\ufffd)\ufffdP\ufffd\u01ad<#\ufffdk\u0010\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\u0005v\ufffd\ufffd\ufffd\ufffd\u0000s\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qHB\ufffd\u0014\ufffda`T\ufffd\ufffd\u0000\ufffd\ufffd\u001b]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\u0010\u001b\ufffd\u0006\ufffdjL \ufffd\ufffdf \u0004K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd\u00159\ufffd\ufffd~\u0014\ufffd\u0247L\ufffdc\u0389g\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a5e2037d09e1592f14b25af9db6492570f7e6f3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qHB\ufffd\u0014\ufffda`T\ufffd\ufffd\u0000\ufffd\ufffd\u001b]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\u0010\u001b\ufffd\u0006\ufffdjL \ufffd\ufffdf \u0004K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd\u00159\ufffd\ufffd~\u0014\ufffd\u0247L\ufffdc\u0389g\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdqHB\ufffd\ufffda`T\ufffd\ufffd\ufffd\ufffd]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\ufffd\ufffdjL \ufffd\ufffdf K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd9\ufffd\ufffd~\ufffd\u0247L\ufffdc\u0389g\ufffd\nm\r\n62.3.50.33\n\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qHB\ufffd\u0014\ufffda`T\ufffd\ufffd\u0000\ufffd\ufffd\u001b]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\u0010\u001b\ufffd\u0006\ufffdjL \ufffd\ufffdf \u0004K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd\u00159\ufffd\ufffd~\u0014\ufffd\u0247L\ufffdc\u0389g\ufffd\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005m\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000",
"tls_ja3": "de8c366fbb06bedcd7b86ddda1addac6",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdqHB\ufffd\ufffda`T\ufffd\ufffd\ufffd\ufffd]}\ufffd&\ufffd\ufffd\ufffdv=\ufffd\ufffd\ufffdjL \ufffd\ufffdf K\ufffd\ufffdP\ufffd\ufffd\u0455Ra\ufffd9\ufffd\ufffd~\ufffd\u0247L\ufffdc\u0389g\ufffd\nm\r\n62.3.50.33\n\ufffd",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.01,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1196e3b1fa255a44 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�w��H � ۢJm8���� ݑc�&$�#p�� ��H$:۹�LmOU����ߑzd)$�r��g�H;�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�w��H
� ۢJm8���� ݑc�&$�#p�� ��H$:۹�LmOU����ߑzd)$�r��g�H;�
Requête brute (extrait)
~ zjm�w��H � ۢJm8���� ݑc�&$�#p�� ��H$:۹�LmOU����ߑzd)$�r��g�H;� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.743003622326169,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "b37fe468eaf314851269e6d40fd47f9f222fafab",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1196e3b1fa255a444a88617c122e45a5",
"payload_hash": "5de8a80797865b4a0352f41451ea44c1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "243a3cd2d8d5dccc5e2fc27a50dcf4c715da69c5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdw\ufffd\ufffdH\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0003~\u0001\u0000\u0003z\u0003\u0002jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "1196e3b1fa255a444a88617c122e45a5",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdw\ufffd\ufffdH\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\ufffd",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9045
|
—
|
Scan de ports
port scan syn · port 9045 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9045
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9045,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5179fcd1e13c547cf7b62d9262d8cfb7e6cb63bf",
"event_fingerprint": "2e436e98c496e43d0e2d727b835b7f069c10dc9b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9045,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8b85755c84cb2818905a63daa240a7582138e16",
"protocol_details": {
"port": 9045
},
"attack_vector": "port scan syn \u00b7 port 9045 \u00b7 (reconnaissance)",
"target_port_label": "9045",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (96 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9045,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9045
},
"attack_vector": "port scan syn \u00b7 port 9045 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9045",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9045"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 96,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9045 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9045 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 16ee84a07b55074c
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9045
Chemin / cible
—
Service
TLS
Payload
i eU ��random1random2random3random4 / 9 � 0 , *
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
i eU ��random1random2random3random4 /
9 � 0
, *
Meta JSON brut
{
"tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 110,
"payload_entropy": 4.269606220838881,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9045,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e8fdde86e110547a82fb2122fb8532b882476a8c",
"event_fingerprint": "df21e8946d9aaa840ef94fc965962cefaa6af3d7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "16ee84a07b55074cb2751329bf1c8811",
"payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "011b865e5f91ae5e1836c88110724dcb",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,47-10-19-57-4-255,13,,",
"tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb",
"tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9045,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb155dada615da8411e288443193c7b5bc276fd6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9045,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"attack_vector": "port scan syn \u00b7 via TLS:9045 \u00b7 (reconnaissance)",
"target_port_label": "9045 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (96 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9045,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9045,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9045 \u00b7 (reconnaissance)",
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"target_port_label": "9045 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9045"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 96,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 3947c3d16bc8cd21 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��v�z�#��D1`@D��r���h*V�(C` �ͮsI�j����������jg����hB�\ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��v�z�#��D1`@D��r���h*V�(C` �ͮsI�j����������jg����hB�\ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� ��v�z�#��D1`@D��r���h*V�(C` �ͮsI�j����������jg����hB�\ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"tls_ja3_hash": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 1695,
"payload_entropy": 7.584735571340015,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "74e8edb31e67d127a32ee479ba63fa0825f8e906",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"payload_hash": "9807c6c04f0e9eee7715de012fe9ad50",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdv\ufffdz\ufffd#\ufffd\ufffd\u0014D1\u0013`\u0007@D\ufffd\ufffdr\u0013\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u000ejg\b\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdv\ufffdz\ufffd#\ufffd\ufffd\u0014D1\u0013`\u0007@D\ufffd\ufffdr\u0013\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u000ejg\b\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdv\ufffdz\ufffd#\ufffd\ufffd\u0014D1\u0013`\u0007@D\ufffd\ufffdr\u0013\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u000ejg\b\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec9eec3b95abbfb17a94d13be5f587cbebe0e621",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdv\ufffdz\ufffd#\ufffd\ufffd\u0014D1\u0013`\u0007@D\ufffd\ufffdr\u0013\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u000ejg\b\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffdz\ufffd#\ufffd\ufffdD1`@D\ufffd\ufffdr\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdjg\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (96 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdv\ufffdz\ufffd#\ufffd\ufffd\u0014D1\u0013`\u0007@D\ufffd\ufffdr\u0013\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u000ejg\b\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"tls_ja3": "3947c3d16bc8cd21ac2296ef9eea028d",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffdz\ufffd#\ufffd\ufffdD1`@D\ufffd\ufffdr\ufffd\ufffd\ufffdh*V\ufffd(C` \ufffd\u036esI\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdjg\ufffd\ufffd\ufffd\ufffdhB\ufffd\\\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 96,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �5 cuv�$��X_��$ڂG��>& �fOa� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5
cuv�$��X_��$ڂG��>& �fOa� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� �5 cuv�$��X_��$ڂG��>& �fOa� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.839066662498264,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "14f8d817d41e077e98e28936d2e828e0d8fbe09a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"payload_hash": "1351424eae2b82800ef9d00c5b2b607c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00025\nc\u0007u\u001bv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\u0015\ufffd\u0017\ufffd>&\f\u0014\ufffdfOa\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00025\nc\u0007u\u001bv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\u0015\ufffd\u0017\ufffd>&\f\u0014\ufffdfOa\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00025\nc\u0007u\u001bv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\u0015\ufffd\u0017\ufffd>&\f\u0014\ufffdfOa\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c20526642edb8c0b38e0c300b8c2719529a7f428",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00025\nc\u0007u\u001bv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\u0015\ufffd\u0017\ufffd>&\f\u0014\ufffdfOa\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd5\ncuv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\ufffd\ufffd>&\ufffdfOa\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (96 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00025\nc\u0007u\u001bv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\u0015\ufffd\u0017\ufffd>&\f\u0014\ufffdfOa\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd5\ncuv\ufffd$\ufffd\ufffdX_\ufffd\ufffd$\u0682G\ufffd\ufffd>&\ufffdfOa\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.2,
"multi_protocol_correlation": true,
"multi_protocol_count": 96,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9045 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9045 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9045
Chemin / cible
—
Service
TLS
Payload
S O ?G���,��`~� ��{�Ֆ�w����<=�o�n ( f e d c b a `
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
S O ?G���,��`~� ��{�Ֆ�w����<=�o�n (
f e d c b a `
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 88,
"payload_entropy": 4.71356415999113,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9045,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 23,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a6fa94504fb124e49bb06e5bb1e0bd63ff80f1b4",
"event_fingerprint": "e6a5c266840420042feb6a7501fe093a0cbae0d7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "80ab07029d5f302cd55bfd003a3a37f1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9045,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df1592760240efa27b56e18ae305f80d56bf5946",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"port": 9045,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`",
"attack_vector": "port scan syn \u00b7 via TLS:9045 \u00b7 (reconnaissance)",
"target_port_label": "9045 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (96 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9045,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"port": 9045,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9045 \u00b7 (reconnaissance)",
"evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`",
"target_port_label": "9045 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9045"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 96,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048
|
—
|
Scan de ports
port scan syn · port 9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "40d63b8dfd6caf8c941871f9861e388c8971cb49",
"event_fingerprint": "01be87a6ca96edabc263dd9ce1f73adf939dedc9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9048,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "395f0f31e372d2af2999d91a6b5f5b8350e351e1",
"protocol_details": {
"port": 9048
},
"attack_vector": "port scan syn \u00b7 port 9048 \u00b7 (reconnaissance)",
"target_port_label": "9048",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9048
},
"attack_vector": "port scan syn \u00b7 port 9048 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9048",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 1.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z V� �-�%95G f ��Jw�b�|�Y� �y ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z V�
�-�%95G f ��Jw�b�|�Y� �y ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z V� �-�%95G f ��Jw�b�|�Y� �y ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.333349124227251,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "7d355f53d4c90f2768ede96fcc596cff26e73615",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "23cd5f8ff4348723936b12a89a3ee647",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\n\u0006\ufffd-\ufffd%95G\u0012\u0006\ff\t\u0011\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\u001f\ufffdy\f\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\n\u0006\ufffd-\ufffd%95G\u0012\u0006\ff\t\u0011\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\u001f\ufffdy\f\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\n\u0006\ufffd-\ufffd%95G\u0012\u0006\ff\t\u0011\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\u001f\ufffdy\f\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72be644c185f84686bfd589a018a44792daafaa7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\n\u0006\ufffd-\ufffd%95G\u0012\u0006\ff\t\u0011\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\u001f\ufffdy\f\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZV\ufffd\n\ufffd-\ufffd%95Gf\t\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\ufffdy\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\ufffd\n\u0006\ufffd-\ufffd%95G\u0012\u0006\ff\t\u0011\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\u001f\ufffdy\f\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "ZV\ufffd\n\ufffd-\ufffd%95Gf\t\ufffd\ufffdJw\ufffdb\ufffd|\ufffdY\ufffd\ufffdy\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 1.45,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 4ae33de1ad939562 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<�
Requête brute (extrait)
~ zjm�x��Ho ۣ�Im9p����ܑd�&$�p�� ��H%!ۺ�LmP$���ߑ{3)$�r��N�H<� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.73852240793123,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "8143d54c0fb9e6bc86dc1cbe48bb7f41f7f4226d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4ae33de1ad93956213297c61748ec996",
"payload_hash": "2acb1107aa098f05f19e3cb823f35c36",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61d78f5854ce49b9bcda21253fc46f817248747a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdx\ufffd\ufffdH\u000eo\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffd\u001ap\ufffd\ufffd \ufffd\ufffdH%!\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\u0011\ufffdr\ufffd\ufffdN\ufffdH<\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd&$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH<\ufffd",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 1.43,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9048
|
—
|
Scan de ports
port scan syn · port 9048 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9048
Chemin / cible
—
Payload
�4 � � � � � @ � �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�4 � � � � � @ � �
Meta JSON brut
{
"bytes_in": 54,
"payload_entropy": 3.705848099200768,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 9048,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "40d63b8dfd6caf8c941871f9861e388c8971cb49",
"event_fingerprint": "01be87a6ca96edabc263dd9ce1f73adf939dedc9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7b673fcc625b3fe0c577928300be63e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9048,
"risk_score": 42
},
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"evidence": {
"request_sample": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"payload_snippet": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1343df17fa5991d751dab141c9661edd3380de3",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9048
},
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 port 9048 \u00b7 (reconnaissance)",
"target_port_label": "9048",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (97 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9048,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\ufffd4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\b\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\u0000\u0000\u0000\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\t\n\u000b\f\r\u000e\u000f",
"port": 9048
},
"attack_vector": "port scan syn \u00b7 port 9048 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd",
"target_port_label": "9048",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9048"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
8104,
8562,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889,
8911
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 1.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 97,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 b5800a9ed884ccf5 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �jm�w��H � ۢJm8���� ݑc�&$�#p�� ��H$:۹�LmOU����ߑzd)$�r��g�H; f 62.3.50.33 # 0
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �jm�w��H
� ۢJm8���� ݑc�&$�#p�� ��H$:۹�LmOU����ߑzd)$�r��g�H;
f
62.3.50.33 #
0
Requête brute (extrait)
� �jm�w��H � ۢJm8���� ݑc�&$�#p�� ��H$:۹�LmOU����ߑzd)$�r��g�H; f 62.3.50.33 # 0 . �c� 3�� �L��ˏ��k�O � W�\�N8�)x� ���`��`
Meta JSON brut
{
"tls_ja3_hash": "b5800a9ed884ccf55e5695ce333b53fb",
"tls_sni": "62.3.50.33",
"bytes_in": 1474,
"payload_entropy": 7.727584734762922,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cc9967946468da8c3b227db17c93d494861a26eb",
"event_fingerprint": "c14f1c081d626c96364071729b665a42bd8a6888",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "b5800a9ed884ccf55e5695ce333b53fb",
"payload_hash": "71343b5416a20e6b538ee46a87157bf5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 \ufffdL\ufffd\ufffd\u02cf\ufffd\ufffdk\ufffdO\u001f\u0019\ufffd\b\rW\ufffd\u0012\u0014\\\u000f\ufffd\u000fN8\ufffd)x\ufffd\u001f\u000b\u0011\ufffd\u0004\ufffd\ufffd`\ufffd\ufffd`",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cd599ceb81c38469e61219c8be7850bb51ab0a0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"tls_ja3": "b5800a9ed884ccf55e5695ce333b53fb",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdjm\ufffdw\ufffd\ufffdH\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\nf\r\n62.3.50.33#\r0",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdw\ufffd\ufffdH\r\ufffd\u0000\u06e2\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\u0010\ufffdr\ufffd\ufffdg\ufffdH;\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"tls_ja3": "b5800a9ed884ccf55e5695ce333b53fb",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdjm\ufffdw\ufffd\ufffdH\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd&$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\nf\r\n62.3.50.33#\r0",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 67625c3bd21c0996 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���V���ȏ��f�)�x���<���� � �� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���V���ȏ��f�)�x���<���� �
�� F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ���V���ȏ��f�)�x���<���� � �� F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"tls_ja3_hash": "67625c3bd21c099689690498fb5b754e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 23,
"bytes_in": 175,
"payload_entropy": 4.871121750923619,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "864d999a46bc2eb713b6f4005b98243c26d28625",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "67625c3bd21c099689690498fb5b754e",
"payload_hash": "8554ca73729259face1252c89696bbe6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0301",
"tls_cipher_count": 35,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffdV\ufffd\ufffd\u0016\ufffd\u020f\ufffd\ufffdf\ufffd\u001b)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\n\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffdV\ufffd\ufffd\u0016\ufffd\u020f\ufffd\ufffdf\ufffd\u001b)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\n\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffdV\ufffd\ufffd\u0016\ufffd\u020f\ufffd\ufffdf\ufffd\u001b)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\n\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "943b99b27ce0086dddb46b6576378a6be1608d87",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffdV\ufffd\ufffd\u0016\ufffd\u020f\ufffd\ufffdf\ufffd\u001b)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\n\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\u020f\ufffd\ufffdf\ufffd)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0001\ufffd\ufffdV\ufffd\ufffd\u0016\ufffd\u020f\ufffd\ufffdf\ufffd\u001b)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\n\ufffd\ufffd\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "67625c3bd21c099689690498fb5b754e",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\u020f\ufffd\ufffdf\ufffd)\ufffdx\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffdF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
� �|��Zy���(=�AW�| � �Q�&}�b �^�� � �J�� ̿h �R�W���+�eN�\n�# � ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �|��Zy���(=�AW�| � �Q�&}�b �^�� � �J�� ̿h �R�W���+�eN�\n�# � ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`
Requête brute (extrait)
� �|��Zy���(=�AW�| � �Q�&}�b �^�� � �J�� ̿h �R�W���+�eN�\n�# � ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 1695,
"payload_entropy": 7.584399656804623,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e4dc36235ece4801a3585fb087e5622f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003|\ufffd\ufffdZy\u0013\ufffd\ufffd\ufffd(=\ufffdAW\u0002\ufffd|\u001c\ufffd\u001d\ufffdQ\ufffd&}\ufffdb\u001c\ufffd^\ufffd\ufffd \ufffd\u000b\ufffdJ\u0001\ufffd\ufffd\b\f\u033fh\u001c\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\u001d\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003|\ufffd\ufffdZy\u0013\ufffd\ufffd\ufffd(=\ufffdAW\u0002\ufffd|\u001c\ufffd\u001d\ufffdQ\ufffd&}\ufffdb\u001c\ufffd^\ufffd\ufffd \ufffd\u000b\ufffdJ\u0001\ufffd\ufffd\b\f\u033fh\u001c\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\u001d\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003|\ufffd\ufffdZy\u0013\ufffd\ufffd\ufffd(=\ufffdAW\u0002\ufffd|\u001c\ufffd\u001d\ufffdQ\ufffd&}\ufffdb\u001c\ufffd^\ufffd\ufffd \ufffd\u000b\ufffdJ\u0001\ufffd\ufffd\b\f\u033fh\u001c\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\u001d\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bd0bc97a04b44320807fee830ebbc57e8be2382",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003|\ufffd\ufffdZy\u0013\ufffd\ufffd\ufffd(=\ufffdAW\u0002\ufffd|\u001c\ufffd\u001d\ufffdQ\ufffd&}\ufffdb\u001c\ufffd^\ufffd\ufffd \ufffd\u000b\ufffdJ\u0001\ufffd\ufffd\b\f\u033fh\u001c\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\u001d\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffd|\ufffd\ufffdZy\ufffd\ufffd\ufffd(=\ufffdAW\ufffd|\ufffd\ufffdQ\ufffd&}\ufffdb\ufffd^\ufffd\ufffd \ufffd\ufffdJ\ufffd\ufffd\u033fh\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003|\ufffd\ufffdZy\u0013\ufffd\ufffd\ufffd(=\ufffdAW\u0002\ufffd|\u001c\ufffd\u001d\ufffdQ\ufffd&}\ufffdb\u001c\ufffd^\ufffd\ufffd \ufffd\u000b\ufffdJ\u0001\ufffd\ufffd\b\f\u033fh\u001c\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\u001d\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd|\ufffd\ufffdZy\ufffd\ufffd\ufffd(=\ufffdAW\ufffd|\ufffd\ufffdQ\ufffd&}\ufffdb\ufffd^\ufffd\ufffd \ufffd\ufffdJ\ufffd\ufffd\u033fh\ufffdR\ufffdW\ufffd\ufffd\ufffd+\ufffdeN\ufffd\\n\ufffd#\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 4ae33de1ad939562 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�v��H � ۡJm7����!ݑb�&$�$p�� ��H#;۸�LmNV����ߑye)$�r��h�H:�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�v��H � ۡJm7����!ݑb�&$�$p�� ��H#;۸�LmNV����ߑye)$�r��h�H:�
Requête brute (extrait)
~ zjm�v��H � ۡJm7����!ݑb�&$�$p�� ��H#;۸�LmNV����ߑye)$�r��h�H:� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.741537018031749,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "e03a03ccc871b1cacd2de6fdcb8c836ab362852c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4ae33de1ad93956213297c61748ec996",
"payload_hash": "72e627ba65045aad3b3a118b8b3dc2ad",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d6ed9c57ac94f687f5e694b3588b873bc776576",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0003~\u0001\u0000\u0003z\u0003\u0003jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "4ae33de1ad93956213297c61748ec996",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\ufffd",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.25,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 11,
"payload_entropy": 2.2221915755066783,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 23,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0048be448ae11e5f229aa494eaad7bfb39f36c75",
"event_fingerprint": "554aaddba403c7976cb749f741e8f1cb24bad26e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "55b6c6b63391f7a244877208a3a6144c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "636892bd07c0ae2fc158f021e05d742dc86c2548",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 23,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0000",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
Z V2J� I��BV��Պ� #[��R��ݴΧ�-M ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z V2J� I��BV��Պ�
#[��R��ݴΧ�-M ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z V2J� I��BV��Պ� #[��R��ݴΧ�-M ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 351,
"payload_entropy": 5.355506336402398,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c645728b7e9eaa4f1d1d20605bafdaaa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00032J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u0013\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd\u0018\u000f-M\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00032J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u0013\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd\u0018\u000f-M\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00032J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u0013\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd\u0018\u000f-M\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84d98eab1dfcd70956f4a1b857beef567c5579eb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00032J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u0013\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd\u0018\u000f-M\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "ZV2J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd-M\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u00032J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u0013\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd\u0018\u000f-M\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "ZV2J\ufffd\tI\ufffd\ufffdBV\ufffd\ufffd\u054a\ufffd\n#[\ufffd\ufffdR\ufffd\ufffd\u0774\u03a7\ufffd-M\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.25,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 1efa91265313b060 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9035
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
Z V v"R���2 ��)��0���;���Ú�K ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
Z V v"R���2 ��)��0���;���Ú�K ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�'
Requête brute (extrait)
Z V v"R���2 ��)��0���;���Ú�K ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F�� � ����Q ����P���� = � < � 5 � / A ��� ; � k 62.
Meta JSON brut
{
"tls_ja3_hash": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 32,
"bytes_in": 351,
"payload_entropy": 5.320511404813275,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a35345f7815f8ec0265430839ea5c7927ef9593",
"event_fingerprint": "7d355f53d4c90f2768ede96fcc596cff26e73615",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1efa91265313b0607d774cf0cdfebe64",
"payload_hash": "5dcd0b384f28359717378cd30cc3e75a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0015\fv\"\u0019R\ufffd\ufffd\u05fa\u0007\ufffd2\u0000\ufffd\ufffd)\ufffd\ufffd\u00060\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0015\fv\"\u0019R\ufffd\ufffd\u05fa\u0007\ufffd2\u0000\ufffd\ufffd)\ufffd\ufffd\u00060\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000;\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u0000k\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.",
"payload_snippet": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0015\fv\"\u0019R\ufffd\ufffd\u05fa\u0007\ufffd2\u0000\ufffd\ufffd)\ufffd\ufffd\u00060\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f845614d1cfe9c36478372e945943d2086f2cfd1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0015\fv\"\u0019R\ufffd\ufffd\u05fa\u0007\ufffd2\u0000\ufffd\ufffd)\ufffd\ufffd\u00060\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "ZVv\"R\ufffd\ufffd\u05fa\ufffd2\ufffd\ufffd)\ufffd\ufffd0\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001Z\u0001\u0000\u0001V\u0003\u0003\u0015\fv\"\u0019R\ufffd\ufffd\u05fa\u0007\ufffd2\u0000\ufffd\ufffd)\ufffd\ufffd\u00060\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\u0000\u0000\ufffd\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'",
"tls_ja3": "1efa91265313b0607d774cf0cdfebe64",
"tls_sni": "62.3.50.33",
"port": 9035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9035 \u00b7 (reconnaissance)",
"evidence_snippet": "ZVv\"R\ufffd\ufffd\u05fa\ufffd2\ufffd\ufffd)\ufffd\ufffd0\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u00da\ufffdK\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd'",
"target_port_label": "9035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9041 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9041 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 e53406bbb3118b0c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
9041
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
~ zjm�v��H � ۡJm7����!ݑb�&$�$p�� ��H#;۸�LmNV����ߑye)$�r��h�H:�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~ zjm�v��H � ۡJm7����!ݑb�&$�$p�� ��H#;۸�LmNV����ߑye)$�r��h�H:�
Requête brute (extrait)
~ zjm�v��H � ۡJm7����!ݑb�&$�$p�� ��H#;۸�LmNV����ߑye)$�r��h�H:� ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F g h i j k l m � � � � � � � � � � � � �
Meta JSON brut
{
"tls_ja3_hash": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 102,
"bytes_in": 899,
"payload_entropy": 5.742683181017991,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 9041,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2646a0e080016be82f59d8ea48e9b86af1758c9",
"event_fingerprint": "b065e66bcfe8bd2a880fc0173fb3ff7106d22ad6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "e53406bbb3118b0c8a662f6717ac159d",
"payload_hash": "588a62c2b06a9a51b91a818f1b725464",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 9041,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000\/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c2aa346ef934493eff7c210864634975395f625",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "~zjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9041,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0003~\u0001\u0000\u0003z\u0003\u0001jm\ufffdv\ufffd\ufffdH\f\ufffd\u0000\u06e1\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\u000f\ufffdr\ufffd\ufffdh\ufffdH:\u0002\ufffd\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018",
"tls_ja3": "e53406bbb3118b0c8a662f6717ac159d",
"tls_sni": "62.3.50.33",
"port": 9041,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9041 \u00b7 (reconnaissance)",
"evidence_snippet": "~zjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd&$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\ufffd",
"target_port_label": "9041 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 f9b8f0bb9fb9f179 SNI 62.3.50.33
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
SNI TLS
62.3.50.33
Payload
� ��5Ȩ�0�]%��C@�7�GYu MRH5��bYb F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��5Ȩ�0�]%��C@�7�GYu
MRH5��bYb F�
� 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A
��� � 7
Requête brute (extrait)
� ��5Ȩ�0�]%��C@�7�GYu MRH5��bYb F� � 9 8 � �� : �� � 3 2 E D� 4 F�� � 5 � / A ��� � 7 62.3.50.33 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 175,
"payload_entropy": 4.835694716979505,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f91605add47c05fd46af11d0025d6015",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like"
},
"tls_ja3_hash": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja3": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2",
"tls_ja4_hash": "62d31e78fdc457d27559991ebb0871be",
"tls_ja4": "t13d0135_d3a8096b2c3a_482398de1203",
"tls_version": "0x0302",
"tls_cipher_count": 35,
"tls_sni": "62.3.50.33",
"ja3_client_category": "browser_like",
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\u0017\ufffd5\u0228\u0002\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYb\u0011\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\u0017\ufffd5\u0228\u0002\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYb\u0011\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\u0017\ufffd5\u0228\u0002\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYb\u0011\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "946654bd9f1bb7e3b60cbf4bc56fee7541d13e5f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\u0017\ufffd5\u0228\u0002\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYb\u0011\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffd\ufffd5\u0228\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYbF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (95 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0002\u0017\ufffd5\u0228\u0002\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYb\u0011\u0000\u0000F\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\ufffd\u0017\u0000\u001b\u00005\u0000\ufffd\u0000\/\u0000A\u0000\n\ufffd\u0006\ufffd\u0010\ufffd\u0015\u0000\u0002\u0000\u0001\u0000\ufffd\u0001\u0000\u00007\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000",
"tls_ja3": "f9b8f0bb9fb9f179320b2833fbe71c48",
"tls_ja4": "62d31e78fdc457d27559991ebb0871be",
"tls_sni": "62.3.50.33",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd5\u0228\ufffd0\ufffd]%\ufffd\ufffdC@\ufffd7\ufffdGYu\rMRH5\ufffd\ufffdbYbF\ufffd\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\n\ufffd\ufffd\ufffd\ufffd7",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 95,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9026 · Sonde VPN/accès distant (OpenVPN/WireGuard/portail)
|
vpn-probe
|
Scan de ports
port scan syn · via Sonde VPN/accès distant (OpenVPN/WireGuard/portail):9026 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
VPN-PROBE
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
vpn_probe_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9026
Chemin / cible
—
Service
Sonde VPN/accès distant (OpenVPN/WireGuard/portail)
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742076706e5f70726f626520726561647920706f72743d393032360d0a",
"emulator_response_len": 40,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": "vpn-probe",
"app_proto": "vpn-probe",
"asn": 396982,
"country": "US",
"dst_port": 9026,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "40eed55ec093fb29b6e26d8a42d6846054996972",
"event_fingerprint": "2fa6ac446b5b7ff719dc24bb18f0b40849c1d93a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "vpn-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9026,
"service": "vpn-probe",
"service_name": "vpn-probe",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7dff95af6d6d73cb90e0ac5ec80359b4833556f7",
"protocol_details": {
"port": 9026,
"service": "vpn-probe",
"service_label_fr": "Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)"
},
"attack_vector": "port scan syn \u00b7 via Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail):9026 \u00b7 (reconnaissance)",
"target_port_label": "9026 \u00b7 Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)",
"emulator_service": "vpn-probe",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail) \u2014 multi-protocole (94 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vpn-probe",
"service_label_fr": "Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)",
"dst_port": 9026,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vpn-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"port": 9026,
"service": "vpn-probe",
"service_label_fr": "Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)"
},
"attack_vector": "port scan syn \u00b7 via Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail):9026 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9026 \u00b7 Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)",
"emulator_service": "vpn-probe",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vpn_probe",
"service_banner": "honeypot-vpn-probe",
"service_os": "linux",
"dst_port": "9026"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 23,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.02,
"multi_protocol_correlation": true,
"multi_protocol_count": 94,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"vpn_probe_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9026 · Sonde VPN/accès distant (OpenVPN/WireGuard/portail)
|
vpn-probe
|
Scan de ports
port scan syn · via Sonde VPN/accès distant (OpenVPN/WireGuard/portail):9026 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 16ee84a07b55074c
Émulateur
VPN-PROBE
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_clienthello
vpn_probe_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9026
Chemin / cible
—
Service
Sonde VPN/accès distant (OpenVPN/WireGuard/portail)
Payload
i eU ��random1random2random3random4 / 9 � 0 , *
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
i eU ��random1random2random3random4 /
9 � 0
, *
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742076706e5f70726f626520726561647920706f72743d393032360d0a",
"emulator_response_len": 40,
"bytes_in": 110,
"payload_entropy": 4.269606220838881,
"port_category": "registered",
"org": "Google LLC",
"service": "vpn-probe",
"app_proto": "vpn-probe",
"asn": 396982,
"country": "US",
"dst_port": 9026,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7b06038a5f3325349281ee4885d0fe1e41ef7b6c",
"event_fingerprint": "2fa6ac446b5b7ff719dc24bb18f0b40849c1d93a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "vpn-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "16ee84a07b55074cb2751329bf1c8811",
"ja4": "011b865e5f91ae5e1836c88110724dcb",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja3": "771,47-10-19-57-4-255,13,,",
"tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb",
"tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9026,
"service": "vpn-probe",
"service_name": "vpn-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2bb4d33efad202af80fad2df21ef55662eee4c36",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9026,
"service": "vpn-probe",
"service_label_fr": "Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)"
},
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"attack_vector": "port scan syn \u00b7 via Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail):9026 \u00b7 (reconnaissance)",
"target_port_label": "9026 \u00b7 Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)",
"emulator_service": "vpn-probe",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail) \u2014 multi-protocole (94 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vpn-probe",
"service_label_fr": "Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)",
"dst_port": 9026,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vpn-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 9026,
"service": "vpn-probe",
"service_label_fr": "Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)"
},
"attack_vector": "port scan syn \u00b7 via Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail):9026 \u00b7 (reconnaissance)",
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"target_port_label": "9026 \u00b7 Sonde VPN\/acc\u00e8s distant (OpenVPN\/WireGuard\/portail)",
"emulator_service": "vpn-probe",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vpn_probe",
"service_banner": "honeypot-vpn-probe",
"service_os": "linux",
"dst_port": "9026"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 23,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.04,
"multi_protocol_correlation": true,
"multi_protocol_count": 94,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_clienthello",
"vpn_probe_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9019 · Scan fichiers backup
|
backup-scan-probe
|
Scan de ports
port scan syn · via Scan fichiers backup:9019 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BACKUP-SCAN-PROBE
WAF
—
Recommandation
Surveiller
Tags
backup_scan_emulated
http_backup_file_scan
net_port_scan_slow
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9019
Chemin / cible
—
Service
Scan fichiers backup
Payload
� �jm�u��H � ۠Jm6����"ݑa�&$�%p�� ��H"<۷�LmMW����ߑxf)$�r��i�H9 f 62.3.50.33 # 0
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �jm�u��H � ۠Jm6����"ݑa�&$�%p�� ��H"<۷�LmMW����ߑxf)$�r��i�H9
f
62.3.50.33 #
0
Requête brute (extrait)
� �jm�u��H � ۠Jm6����"ݑa�&$�%p�� ��H"<۷�LmMW����ߑxf)$�r��i�H9 f 62.3.50.33 # 0 . �c� 3�� ������� ��nd��A��J�b2��]��~fh�����;
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206261636b75705f7363616e5f70726f626520726561647920706f72743d393031390d0a",
"emulator_response_len": 48,
"bytes_in": 1474,
"payload_entropy": 7.765486531679166,
"port_category": "registered",
"org": "Google LLC",
"service": "backup-scan-probe",
"app_proto": "backup-scan-probe",
"asn": 396982,
"country": "US",
"dst_port": 9019,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e0bfaa4760accdac4d2f1d23d617217564c333a",
"event_fingerprint": "c0d3a3f044ad03a970bccede2772b0f1a2d6a8b1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "backup-scan-probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5328d145b84edaf96e13958d71ca8cad",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9019,
"service": "backup-scan-probe",
"service_name": "backup-scan-probe",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u0018\u0000\u0016\u0000\u0017\u0000\u0019\u0000\u0018\u0000\u001d\u0000\u001e\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0011\ufffdc\ufffd\u00003\u0004\ufffd\u0004\ufffd\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\u001c\ufffd\ufffdnd\ufffd\ufffdA\ufffd\ufffdJ\ufffd\u0006b2\ufffd\ufffd]\ufffd\ufffd~f\u0006h\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u0013\ufffd;",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "013543ae14ec3265c6fa149e190d6d9e90f5e609",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"evidence_snippet": "\ufffd\ufffdjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\nf\r\n62.3.50.33#\r0",
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Scan fichiers backup \u2014 multi-protocole (94 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup",
"dst_port": 9019,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-backup-scan-probe",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003jm\ufffdu\ufffd\ufffdH\u000b\ufffd\u0000\u06e0\u0013Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\u000e\ufffdr\ufffd\ufffdi\ufffdH9\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\u0001\u0000\u0005f\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000",
"port": 9019,
"service": "backup-scan-probe",
"service_label_fr": "Scan fichiers backup"
},
"attack_vector": "port scan syn \u00b7 via Scan fichiers backup:9019 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\"\u0751a\ufffd&$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\"<\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\nf\r\n62.3.50.33#\r0",
"target_port_label": "9019 \u00b7 Scan fichiers backup",
"emulator_service": "backup-scan-probe",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "backup_scan_probe",
"service_banner": "honeypot-backup-scan-probe",
"service_os": "linux",
"dst_port": "9019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 23,
"port_scan_ports_sample": [
8104,
8562,
8728,
8800,
8807,
8822,
8827,
8830,
8832,
8833,
8834,
8840,
8879,
8880,
8888,
8889
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.01,
"multi_protocol_correlation": true,
"multi_protocol_count": 94,
"multi_protocol_sample": [
"activemq-console",
"backup-scan-probe",
"clickhouse-http",
"consul",
"ftp-proxy",
"github-webhook",
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"backup_scan_emulated",
"http_backup_file_scan",
"net_port_scan_slow",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|