Renseignement sur les menaces

États-Unis

34.68.34.69

FAI Google LLC Première vue 05/08/2026 16:04 UTC Dernière vue 05/08/2026 16:28 UTC Risque Élevé

Période analysée : 2026-07-07 → 2026-08-06

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — multi-protocole (234 protocoles · 5 min)

Campagne de scan — plusieurs IP du même /24 (34.68.34.0/24, ≥3 pairs)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Élevé · Risque max (7j) Élevé

Synthèse exécutive

Profil de menace

Score de risque 69/100 Élevé

Première observation 05/08/2026 16:04 UTC

Dernière observation 05/08/2026 16:28 UTC

Événements (période) 12,217

MITRE ATT&CK principal T1046 10904 occurrences

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — multi-protocole (234 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +28

Comparaison ASN / FAI

ASN 396982 · 34.68.32.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 12,217 événements sur la période pour cette IP.

162.216.149.97 Scanner web 06/08/2026 21:57 UTC
35.203.210.12 Scanner web 06/08/2026 21:55 UTC
198.235.24.109 Scanner web 06/08/2026 21:54 UTC
205.210.31.205 Scanner web 06/08/2026 21:53 UTC
162.216.149.9 Scanner web 06/08/2026 21:50 UTC
66.249.64.38 SSRF 06/08/2026 21:50 UTC
198.235.24.48 Sonde PostgreSQL 06/08/2026 21:50 UTC
205.210.31.251 Scanner web 06/08/2026 21:48 UTC

Événements (filtres)

12,217

Première observation

05/08/2026 16:04 UTC

Dernière observation

05/08/2026 16:28 UTC

Dernière activité (filtres)

05/08/2026 16:28 UTC

Événements 7j

12,217

Ports distincts (7j)

1063

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 3,289 TLS TCP 865 VNC TCP 416 MSSQL TCP 414 SAP ICM TCP 83 WINRM TCP 79 COUCHDB TCP 50 ELASTICSEARCH TCP 44 LDAP TCP 32 BITCOIN TCP 28 DOCKER TCP 25 SMB TCP 24 SAP Diag TCP 23 VMWARE AUTH TCP 19 VNC 3 TCP 18 GAME UNREAL TCP 18 ZOOKEEPER TCP 18 SAP MS TCP 18 I2P TCP 18 RPCBIND TCP 18

HTTP

3,289

TLS

865

VNC

416

MSSQL

414

SAP ICM

WINRM

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Google LLC 0 Port 8888 port_scan_syn

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · port 9068 · (reconnaissance)

Détails protocole

Port / service

9068

Raison confiance

Confiance 100 % — 1 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +28

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

12,217 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

12217 événement(s) — page 1/245

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload stats quit Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Memcached stats Memcached stats ET Memcached UDP User-Agent — Règles WAF — Payload (extrait) stats quit Meta JSON brut { "bytes_in": 15, "payload_entropy": 2.822579761842491, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0374", "pat-0533", "pat-0865" ], "matched_pattern_names": [ "Memcached stats", "Memcached stats", "ET Memcached UDP" ], "pattern_ids": [ "pat-0374", "pat-0533", "pat-0865" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b6167d063664acd0adfde8c56cf6184c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "stats\r\n\r\nquit\r\n", "request_sample": "stats\r\n\r\nquit\r\n", "payload_snippet": "stats\r\n\r\nquit", "evidence": { "request_sample": "stats\r\n\r\nquit\r\n", "payload_snippet": "stats\r\n\r\nquit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "159471f8c8a288ccf70f267c422f307c1cca4a20", "protocol_details": { "payload_preview": "stats\r\n\r\nquit", "port": 9068 }, "evidence_snippet": "stats\r\n\r\nquit", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "stats\r\n\r\nquit", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "stats\r\n\r\nquit", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.2, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068 · MSSQL	mssql	Scan de ports port scan syn · via MSSQL:9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_tds net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Service MSSQL Payload : ! -1� MSSQLServer<� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) : !-1� MSSQLServer<� Meta JSON brut { "bytes_in": 58, "payload_entropy": 3.4275271990270237, "port_category": "registered", "org": "Google LLC", "service": "mssql", "app_proto": "mssql", "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e2a96e7245009641d181584c8baeb481ceb17a48", "event_fingerprint": "3075e8ff8f4747e5841abff4f11311e5f014405f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0519", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c254a2e0618be32415a97df79ee8d3b4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "service": "mssql", "service_name": "mssql", "risk_score": 42 }, "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "evidence": { "request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5779fa5559f8f6917839bd0efe674d6bb44acde5", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "port": 9068, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd", "attack_vector": "port scan syn \u00b7 via MSSQL:9068 \u00b7 (reconnaissance)", "target_port_label": "9068 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MSSQL \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "port": 9068, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "port scan syn \u00b7 via MSSQL:9068 \u00b7 (reconnaissance)", "evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd", "target_port_label": "9068 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.26, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_tds", "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001 Meta JSON brut { "bytes_in": 60, "payload_entropy": 4.406669454469437, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "evidence": { "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "546b782523cef070254cf2d2b9aa3f03b6f7000d", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "port": 9068 }, "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.26, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 2, "payload_entropy": 1, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7eb70257593da06f682a3ddda54a9d26", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "\r\n", "request_sample": "\r\n", "evidence": { "request_sample": "\r\n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b017c4d8968bc67fd6b7ba70476acd135b30aefd", "protocol_details": { "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload zal238hcxjky129xz@!# Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) zal238hcxjky129xz@!# Meta JSON brut { "bytes_in": 23, "payload_entropy": 4.262692390839622, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c1a1715b3efb95433e20233a8eef266d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "request_sample": "\u0000\u0015zal238hcxjky129xz@!#", "payload_snippet": "\u0000\u0015zal238hcxjky129xz@!#", "evidence": { "request_sample": "\u0000\u0015zal238hcxjky129xz@!#", "payload_snippet": "\u0000\u0015zal238hcxjky129xz@!#", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "110e76165e05382d8adfd24634e919d20bb5254b", "protocol_details": { "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "port": 9068 }, "evidence_snippet": "zal238hcxjky129xz@!#", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "zal238hcxjky129xz@!#", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload WHOAREYOU? Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) WHOAREYOU? Meta JSON brut { "bytes_in": 10, "payload_entropy": 3.121928094887362, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "762698422aeb434c563df0d64d39eea3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "WHOAREYOU?", "request_sample": "WHOAREYOU?", "payload_snippet": "WHOAREYOU?", "evidence": { "request_sample": "WHOAREYOU?", "payload_snippet": "WHOAREYOU?", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "09ee480c934b7186a9f3b0c3dc0a3e4e8a8e28bd", "protocol_details": { "payload_preview": "WHOAREYOU?", "port": 9068 }, "evidence_snippet": "WHOAREYOU?", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "WHOAREYOU?", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "WHOAREYOU?", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) SMB negotiate Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 24, "payload_entropy": 1.0238995733215064, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SMB negotiate", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b54520be3d454f6926b094aac799ac34", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f042fa142dff22763ba8d27a2f4eddf2d67720ab", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068 · VNC	vnc	Scan de ports port scan syn · via VNC:9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_port_scan_slow vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Service VNC Payload RFB 003.003 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) RFB 003.003 Meta JSON brut { "bytes_in": 12, "payload_entropy": 2.751629167387823, "port_category": "registered", "org": "Google LLC", "service": "vnc", "app_proto": "vnc", "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "210d5c64f3fb57eaf01d3a948d9858e6050597a6", "event_fingerprint": "da132ba3d1c0dc69558869b00b2ca17674f8c6c2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "vnc", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ba4bf75c6ca831dd6ab37a2c5e7413b5", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "service": "vnc", "service_name": "vnc", "risk_score": 42 }, "payload_preview": "RFB 003.003\n", "request_sample": "RFB 003.003\n", "payload_snippet": "RFB 003.003", "evidence": { "request_sample": "RFB 003.003\n", "payload_snippet": "RFB 003.003", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "105d947bd05fac35f3da92a7f6e3196ff456f715", "protocol_details": { "payload_preview": "RFB 003.003", "port": 9068, "service": "vnc", "service_label_fr": "VNC" }, "evidence_snippet": "RFB 003.003", "attack_vector": "port scan syn \u00b7 via VNC:9068 \u00b7 (reconnaissance)", "target_port_label": "9068 \u00b7 VNC", "emulator_service": "vnc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "vnc", "service_label_fr": "VNC", "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-vnc", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "RFB 003.003", "port": 9068, "service": "vnc", "service_label_fr": "VNC" }, "attack_vector": "port scan syn \u00b7 via VNC:9068 \u00b7 (reconnaissance)", "evidence_snippet": "RFB 003.003", "target_port_label": "9068 \u00b7 VNC", "emulator_service": "vnc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "vnc", "service_banner": "honeypot-vnc", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "vnc_banner" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload envi quit Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) envi quit Meta JSON brut { "bytes_in": 12, "payload_entropy": 3.084962500721156, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b66d77430fe371a75bb9845dd40b7d3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "envi\r\nquit\r\n", "request_sample": "envi\r\nquit\r\n", "payload_snippet": "envi\r\nquit", "evidence": { "request_sample": "envi\r\nquit\r\n", "payload_snippet": "envi\r\nquit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1656fded20c9711c4abd9e970c285d2f4aae4e0", "protocol_details": { "payload_preview": "envi\r\nquit", "port": 9068 }, "evidence_snippet": "envi\r\nquit", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "envi\r\nquit", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "envi\r\nquit", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload GIOP NameService Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header GIOP WebSphere IIOP ET H.323 setup NFS RPC mount Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) GIOPNameService Meta JSON brut { "bytes_in": 35, "payload_entropy": 3.4133442623458246, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0348", "pat-0605", "pat-0868", "pat-0532", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "GIOP WebSphere IIOP", "ET H.323 setup", "NFS RPC mount", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0605", "pat-0868", "pat-0532", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ee188bd883954b153869cc7ff2dcd2b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "evidence": { "request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9ea4c9388604fa0523b41820d0a06cf2f23649c1", "protocol_details": { "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "port": 9068 }, "evidence_snippet": "GIOPNameService", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "GIOPNameService", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload help\r\n Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) OPC UA HEL User-Agent — Règles WAF — Payload (extrait) help\r\n Meta JSON brut { "bytes_in": 8, "payload_entropy": 2.75, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0626" ], "matched_pattern_names": [ "OPC UA HEL" ], "pattern_ids": [ "pat-0626" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1ca107f6ced851d3e7dedfb06144f2f1", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "help\\r\\n", "request_sample": "help\\r\\n", "payload_snippet": "help\\r\\n", "evidence": { "request_sample": "help\\r\\n", "payload_snippet": "help\\r\\n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "74c13a3d83405826f87673e0865975175068f0e4", "protocol_details": { "payload_preview": "help\\r\\n", "port": 9068 }, "evidence_snippet": "help\\r\\n", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "help\\r\\n", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "help\\r\\n", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload Z:8 �� :AA(CONNECT_DATA=(COMMAND=VERSION)) Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Z:8 �� :AA(CONNECT_DATA=(COMMAND=VERSION)) Meta JSON brut { "bytes_in": 90, "payload_entropy": 3.363000349268878, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4af072de9a74c3ed767895a558661d0c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "evidence": { "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10bc8b74a5a44906428c389c4bb7fdc9532fd97f", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "port": 9068 }, "evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:08 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fe56256b2e095461feeaf8d0dcd7bc0ce517ac5e", "protocol_details": { "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (234 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 0.83, "multi_protocol_correlation": true, "multi_protocol_count": 234, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1481091d643763c885c96a41323c210a216c6ca", "protocol_details": { "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (235 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.04, "multi_protocol_correlation": true, "multi_protocol_count": 235, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload Z:8 �� :AA(CONNECT_DATA=(COMMAND=VERSION)) Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Z:8 �� :AA(CONNECT_DATA=(COMMAND=VERSION)) Meta JSON brut { "bytes_in": 90, "payload_entropy": 3.363000349268878, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4af072de9a74c3ed767895a558661d0c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "evidence": { "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "63f1f281bcfce940131ac5f915d9a1836fdff9d8", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "port": 9066 }, "evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.2, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload WHOAREYOU? Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) WHOAREYOU? Meta JSON brut { "bytes_in": 10, "payload_entropy": 3.121928094887362, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "762698422aeb434c563df0d64d39eea3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "WHOAREYOU?", "request_sample": "WHOAREYOU?", "payload_snippet": "WHOAREYOU?", "evidence": { "request_sample": "WHOAREYOU?", "payload_snippet": "WHOAREYOU?", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5caaecfceab5e62c3f6ebe5536b5303621298485", "protocol_details": { "payload_preview": "WHOAREYOU?", "port": 9066 }, "evidence_snippet": "WHOAREYOU?", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "WHOAREYOU?", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "WHOAREYOU?", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.2, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload help\r\n Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) OPC UA HEL User-Agent — Règles WAF — Payload (extrait) help\r\n Meta JSON brut { "bytes_in": 8, "payload_entropy": 2.75, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0626" ], "matched_pattern_names": [ "OPC UA HEL" ], "pattern_ids": [ "pat-0626" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1ca107f6ced851d3e7dedfb06144f2f1", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "help\\r\\n", "request_sample": "help\\r\\n", "payload_snippet": "help\\r\\n", "evidence": { "request_sample": "help\\r\\n", "payload_snippet": "help\\r\\n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a29a5bb24933d4caf9fa362d989911b16d9fda1d", "protocol_details": { "payload_preview": "help\\r\\n", "port": 9066 }, "evidence_snippet": "help\\r\\n", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "help\\r\\n", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "help\\r\\n", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.26, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload stats quit Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Memcached stats Memcached stats ET Memcached UDP User-Agent — Règles WAF — Payload (extrait) stats quit Meta JSON brut { "bytes_in": 15, "payload_entropy": 2.822579761842491, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0374", "pat-0533", "pat-0865" ], "matched_pattern_names": [ "Memcached stats", "Memcached stats", "ET Memcached UDP" ], "pattern_ids": [ "pat-0374", "pat-0533", "pat-0865" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b6167d063664acd0adfde8c56cf6184c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "stats\r\n\r\nquit\r\n", "request_sample": "stats\r\n\r\nquit\r\n", "payload_snippet": "stats\r\n\r\nquit", "evidence": { "request_sample": "stats\r\n\r\nquit\r\n", "payload_snippet": "stats\r\n\r\nquit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "356f60ae0c169385d7382e867f98f9eaa30ec92d", "protocol_details": { "payload_preview": "stats\r\n\r\nquit", "port": 9066 }, "evidence_snippet": "stats\r\n\r\nquit", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "stats\r\n\r\nquit", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "stats\r\n\r\nquit", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.26, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload envi quit Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) envi quit Meta JSON brut { "bytes_in": 12, "payload_entropy": 3.084962500721156, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b66d77430fe371a75bb9845dd40b7d3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "envi\r\nquit\r\n", "request_sample": "envi\r\nquit\r\n", "payload_snippet": "envi\r\nquit", "evidence": { "request_sample": "envi\r\nquit\r\n", "payload_snippet": "envi\r\nquit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47ecca1fdc462091d789a5f9cc1b58244fa5a048", "protocol_details": { "payload_preview": "envi\r\nquit", "port": 9066 }, "evidence_snippet": "envi\r\nquit", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "envi\r\nquit", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "envi\r\nquit", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.26, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload zal238hcxjky129xz@!# Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) zal238hcxjky129xz@!# Meta JSON brut { "bytes_in": 23, "payload_entropy": 4.262692390839622, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c1a1715b3efb95433e20233a8eef266d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "request_sample": "\u0000\u0015zal238hcxjky129xz@!#", "payload_snippet": "\u0000\u0015zal238hcxjky129xz@!#", "evidence": { "request_sample": "\u0000\u0015zal238hcxjky129xz@!#", "payload_snippet": "\u0000\u0015zal238hcxjky129xz@!#", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c9b0c3650170e20fa64808665535ea7616651cb", "protocol_details": { "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "port": 9066 }, "evidence_snippet": "zal238hcxjky129xz@!#", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "zal238hcxjky129xz@!#", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload GIOP NameService Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header GIOP WebSphere IIOP ET H.323 setup NFS RPC mount Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) GIOPNameService Meta JSON brut { "bytes_in": 35, "payload_entropy": 3.4133442623458246, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0348", "pat-0605", "pat-0868", "pat-0532", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "GIOP WebSphere IIOP", "ET H.323 setup", "NFS RPC mount", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0605", "pat-0868", "pat-0532", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ee188bd883954b153869cc7ff2dcd2b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "evidence": { "request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f56dd3a3cb52369020508e56b45376b8a8135eb4", "protocol_details": { "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "port": 9066 }, "evidence_snippet": "GIOPNameService", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "GIOPNameService", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) SMB negotiate Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 24, "payload_entropy": 1.0238995733215064, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SMB negotiate", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b54520be3d454f6926b094aac799ac34", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3ed926a72db899ddd0e8cae546352ab9436085a6", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.25, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066 · MSSQL	mssql	Scan de ports port scan syn · via MSSQL:9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_tds net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Service MSSQL Payload : ! -1� MSSQLServer<� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) : !-1� MSSQLServer<� Meta JSON brut { "bytes_in": 58, "payload_entropy": 3.4275271990270237, "port_category": "registered", "org": "Google LLC", "service": "mssql", "app_proto": "mssql", "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "54080deec0523c66865eda936c791f3b620f80ba", "event_fingerprint": "7db75adc282abcb9d453cae920a0f5e4b1aa3e08", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0519", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c254a2e0618be32415a97df79ee8d3b4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "service": "mssql", "service_name": "mssql", "risk_score": 42 }, "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "evidence": { "request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e7e3c8e6418f4768a6e954cbdfcac3e25df8c89a", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "port": 9066, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd", "attack_vector": "port scan syn \u00b7 via MSSQL:9066 \u00b7 (reconnaissance)", "target_port_label": "9066 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MSSQL \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "port": 9066, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "port scan syn \u00b7 via MSSQL:9066 \u00b7 (reconnaissance)", "evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd", "target_port_label": "9066 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_tds", "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 2, "payload_entropy": 1, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7eb70257593da06f682a3ddda54a9d26", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "\r\n", "request_sample": "\r\n", "evidence": { "request_sample": "\r\n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "341bd9a7a33f439ac6c4e12bc92ddbb25f79ca71", "protocol_details": { "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066 · VNC	vnc	Scan de ports port scan syn · via VNC:9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_port_scan_slow vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Service VNC Payload RFB 003.003 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) RFB 003.003 Meta JSON brut { "bytes_in": 12, "payload_entropy": 2.751629167387823, "port_category": "registered", "org": "Google LLC", "service": "vnc", "app_proto": "vnc", "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "d5c68f284501599c291d7522d54f9a1cbeb47b41", "event_fingerprint": "24d8fac3946d683777eaa8fec7f89e632cb56597", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "vnc", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ba4bf75c6ca831dd6ab37a2c5e7413b5", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "service": "vnc", "service_name": "vnc", "risk_score": 42 }, "payload_preview": "RFB 003.003\n", "request_sample": "RFB 003.003\n", "payload_snippet": "RFB 003.003", "evidence": { "request_sample": "RFB 003.003\n", "payload_snippet": "RFB 003.003", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "413db64820a1e3c200f488f196162074dd78fea2", "protocol_details": { "payload_preview": "RFB 003.003", "port": 9066, "service": "vnc", "service_label_fr": "VNC" }, "evidence_snippet": "RFB 003.003", "attack_vector": "port scan syn \u00b7 via VNC:9066 \u00b7 (reconnaissance)", "target_port_label": "9066 \u00b7 VNC", "emulator_service": "vnc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "vnc", "service_label_fr": "VNC", "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-vnc", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "RFB 003.003", "port": 9066, "service": "vnc", "service_label_fr": "VNC" }, "attack_vector": "port scan syn \u00b7 via VNC:9066 \u00b7 (reconnaissance)", "evidence_snippet": "RFB 003.003", "target_port_label": "9066 \u00b7 VNC", "emulator_service": "vnc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "vnc", "service_banner": "honeypot-vnc", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "vnc_banner" ], "asn_dc_heuristic": true }
05/08/2026 16:28:07 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001 Meta JSON brut { "bytes_in": 60, "payload_entropy": 4.406669454469437, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "evidence": { "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "09041e4058f1db7cfcc8e55417de706f3983240a", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "port": 9066 }, "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff1e77007ed1b3bccc36a79945ed35775cfd623d", "protocol_details": { "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (235 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 48, "port_scan_ports_sample": [ 8888, 8889, 8911, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009, 9011, 9013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.02, "multi_protocol_correlation": true, "multi_protocol_count": 235, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload GIOP NameService Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header GIOP WebSphere IIOP ET H.323 setup NFS RPC mount Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) GIOPNameService Meta JSON brut { "bytes_in": 35, "payload_entropy": 3.4133442623458246, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0348", "pat-0605", "pat-0868", "pat-0532", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "GIOP WebSphere IIOP", "ET H.323 setup", "NFS RPC mount", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0605", "pat-0868", "pat-0532", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ee188bd883954b153869cc7ff2dcd2b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "evidence": { "request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "270f559979514db31dbe633985004b2191bb6c44", "protocol_details": { "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "port": 9058 }, "evidence_snippet": "GIOPNameService", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "GIOPNameService", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.14, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058 · VNC	vnc	Scan de ports port scan syn · via VNC:9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_port_scan_slow vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Service VNC Payload RFB 003.003 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) RFB 003.003 Meta JSON brut { "bytes_in": 12, "payload_entropy": 2.751629167387823, "port_category": "registered", "org": "Google LLC", "service": "vnc", "app_proto": "vnc", "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ca73f8382dd854cec848c0650e667050229f8fe1", "event_fingerprint": "1c375e63f6edcea4e5f759b1d757755c2664a99b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "vnc", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ba4bf75c6ca831dd6ab37a2c5e7413b5", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "service": "vnc", "service_name": "vnc", "risk_score": 42 }, "payload_preview": "RFB 003.003\n", "request_sample": "RFB 003.003\n", "payload_snippet": "RFB 003.003", "evidence": { "request_sample": "RFB 003.003\n", "payload_snippet": "RFB 003.003", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "421b04278d235788355c4fb806c93fa46e9dddbe", "protocol_details": { "payload_preview": "RFB 003.003", "port": 9058, "service": "vnc", "service_label_fr": "VNC" }, "evidence_snippet": "RFB 003.003", "attack_vector": "port scan syn \u00b7 via VNC:9058 \u00b7 (reconnaissance)", "target_port_label": "9058 \u00b7 VNC", "emulator_service": "vnc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "vnc", "service_label_fr": "VNC", "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-vnc", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "RFB 003.003", "port": 9058, "service": "vnc", "service_label_fr": "VNC" }, "attack_vector": "port scan syn \u00b7 via VNC:9058 \u00b7 (reconnaissance)", "evidence_snippet": "RFB 003.003", "target_port_label": "9058 \u00b7 VNC", "emulator_service": "vnc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "vnc", "service_banner": "honeypot-vnc", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.14, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "vnc_banner" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 2, "payload_entropy": 1, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7eb70257593da06f682a3ddda54a9d26", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "\r\n", "request_sample": "\r\n", "evidence": { "request_sample": "\r\n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0717af96d24e118af978d7ffd2986b3f7f1f872", "protocol_details": { "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.14, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload Z:8 �� :AA(CONNECT_DATA=(COMMAND=VERSION)) Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Z:8 �� :AA(CONNECT_DATA=(COMMAND=VERSION)) Meta JSON brut { "bytes_in": 90, "payload_entropy": 3.363000349268878, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4af072de9a74c3ed767895a558661d0c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "evidence": { "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bad7224110ceb29f11628346ee42b0583cf6d6dd", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "port": 9058 }, "evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u0001:\u00018\u0000\u0000 \u0000\ufffd\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=VERSION))", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "Z:8 \ufffd\ufffd :AA(CONNECT_DATA=(COMMAND=VERSION))", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.14, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload stats quit Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Memcached stats Memcached stats ET Memcached UDP User-Agent — Règles WAF — Payload (extrait) stats quit Meta JSON brut { "bytes_in": 15, "payload_entropy": 2.822579761842491, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0374", "pat-0533", "pat-0865" ], "matched_pattern_names": [ "Memcached stats", "Memcached stats", "ET Memcached UDP" ], "pattern_ids": [ "pat-0374", "pat-0533", "pat-0865" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b6167d063664acd0adfde8c56cf6184c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "stats\r\n\r\nquit\r\n", "request_sample": "stats\r\n\r\nquit\r\n", "payload_snippet": "stats\r\n\r\nquit", "evidence": { "request_sample": "stats\r\n\r\nquit\r\n", "payload_snippet": "stats\r\n\r\nquit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "244cc9fef63167d66ef3e9f2135e0fe828e030cb", "protocol_details": { "payload_preview": "stats\r\n\r\nquit", "port": 9058 }, "evidence_snippet": "stats\r\n\r\nquit", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "stats\r\n\r\nquit", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "stats\r\n\r\nquit", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.14, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058 · MSSQL	mssql	Scan de ports port scan syn · via MSSQL:9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_tds net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Service MSSQL Payload : ! -1� MSSQLServer<� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) : !-1� MSSQLServer<� Meta JSON brut { "bytes_in": 58, "payload_entropy": 3.4275271990270237, "port_category": "registered", "org": "Google LLC", "service": "mssql", "app_proto": "mssql", "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "5471396888bd44931d3d26d58bdde0a96a754f8c", "event_fingerprint": "412b61d76cf14d19420cba08b28bc419704a3316", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0519", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c254a2e0618be32415a97df79ee8d3b4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "service": "mssql", "service_name": "mssql", "risk_score": 42 }, "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "evidence": { "request_sample": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "payload_snippet": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b30773a86cb5b3d90a2076ddeb4f23b1566c137", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "port": 9058, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd", "attack_vector": "port scan syn \u00b7 via MSSQL:9058 \u00b7 (reconnaissance)", "target_port_label": "9058 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MSSQL \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001\ufffd\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000<\ufffd\u0000\u0000\u0000", "port": 9058, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "port scan syn \u00b7 via MSSQL:9058 \u00b7 (reconnaissance)", "evidence_snippet": ": !-1\ufffd\tMSSQLServer<\ufffd", "target_port_label": "9058 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.14, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_tds", "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload help\r\n Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) OPC UA HEL User-Agent — Règles WAF — Payload (extrait) help\r\n Meta JSON brut { "bytes_in": 8, "payload_entropy": 2.75, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0626" ], "matched_pattern_names": [ "OPC UA HEL" ], "pattern_ids": [ "pat-0626" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1ca107f6ced851d3e7dedfb06144f2f1", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "help\\r\\n", "request_sample": "help\\r\\n", "payload_snippet": "help\\r\\n", "evidence": { "request_sample": "help\\r\\n", "payload_snippet": "help\\r\\n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c776c5ff225ce85a26803f9beddcdab63bec8ceb", "protocol_details": { "payload_preview": "help\\r\\n", "port": 9058 }, "evidence_snippet": "help\\r\\n", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "help\\r\\n", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "help\\r\\n", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.13, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) SMB negotiate Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 24, "payload_entropy": 1.0238995733215064, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SMB negotiate", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b54520be3d454f6926b094aac799ac34", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47e552e189879a4ab909c13f4d8f2620dbdcd5cc", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.13, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload WHOAREYOU? Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) WHOAREYOU? Meta JSON brut { "bytes_in": 10, "payload_entropy": 3.121928094887362, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "762698422aeb434c563df0d64d39eea3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "WHOAREYOU?", "request_sample": "WHOAREYOU?", "payload_snippet": "WHOAREYOU?", "evidence": { "request_sample": "WHOAREYOU?", "payload_snippet": "WHOAREYOU?", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d6a40eff8bf29e49f4bf3e0835fecf0cbec7dd6", "protocol_details": { "payload_preview": "WHOAREYOU?", "port": 9058 }, "evidence_snippet": "WHOAREYOU?", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "WHOAREYOU?", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "WHOAREYOU?", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.13, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) t3 12.2.1 AS:255 HL:19 MS:10000000 PU:t3://us-l-breens:7001 Meta JSON brut { "bytes_in": 60, "payload_entropy": 4.406669454469437, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8cfd34767c2242ef7f77ad6fd88713c8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "evidence": { "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dfebfa7fcc0b9079505c97d1ff2e7308ddd92c22", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "port": 9058 }, "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3:\/\/us-l-breens:7001", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.13, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload zal238hcxjky129xz@!# Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) zal238hcxjky129xz@!# Meta JSON brut { "bytes_in": 23, "payload_entropy": 4.262692390839622, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c1a1715b3efb95433e20233a8eef266d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "request_sample": "\u0000\u0015zal238hcxjky129xz@!#", "payload_snippet": "\u0000\u0015zal238hcxjky129xz@!#", "evidence": { "request_sample": "\u0000\u0015zal238hcxjky129xz@!#", "payload_snippet": "\u0000\u0015zal238hcxjky129xz@!#", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1874bbf5c265810ff2be9205dd022b5edec2a3b6", "protocol_details": { "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "port": 9058 }, "evidence_snippet": "zal238hcxjky129xz@!#", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0000\u0015zal238hcxjky129xz@!#", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "zal238hcxjky129xz@!#", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.13, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload envi quit Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) envi quit Meta JSON brut { "bytes_in": 12, "payload_entropy": 3.084962500721156, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b66d77430fe371a75bb9845dd40b7d3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "envi\r\nquit\r\n", "request_sample": "envi\r\nquit\r\n", "payload_snippet": "envi\r\nquit", "evidence": { "request_sample": "envi\r\nquit\r\n", "payload_snippet": "envi\r\nquit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1b5d1a8e010f7d31bd0d48e46ccaff2213ce75a", "protocol_details": { "payload_preview": "envi\r\nquit", "port": 9058 }, "evidence_snippet": "envi\r\nquit", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "envi\r\nquit", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "envi\r\nquit", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.12, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9073 · TLS	tls	Scan de ports port scan syn · via TLS:9073 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2079bcc000c9a54e Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9073 Chemin / cible — Service TLS Payload ��c��b��$�uÜ��q:� ~��H��-��͒�NXF\c�H'��+�/�,�0̨̩� �� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��c��b��$�uÜ��q:� ~��H��-��͒�NXF\c�H'��+�/�,�0̨̩� �� Requête brute (extrait) ��c��b��$�uÜ��q:� ~��H��-��͒�NXF\c�H'��+�/�,�0̨̩� �� 2+3&$ Q�Nu��1+\�f 6��`@BEX Meta JSON brut { "tls_ja3_hash": "2079bcc000c9a54e0784733c0142d140", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 1, "bytes_in": 263, "payload_entropy": 5.74222287416098, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9073, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "abddf6212002961beeee42764ec64029d173499c", "event_fingerprint": "b37594600033e7f0c7d17659b9d6039d1670a9ff", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "2079bcc000c9a54e0784733c0142d140", "payload_hash": "ac50d180625b27a48f181bafade48fa8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9073, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\u0001\ufffd\ufffd\ufffd\u0002\ufffd\u001e\ufffd\u000f\u0007q:\ufffd ~\ufffd\u0016\ufffdH\ufffd\ufffd\u0016\ufffd-\ufffd\ufffd\ufffd\u000e\ufffd\u0352\ufffdN\u0019XF\\c\ufffdH\u000f'\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\u0001\ufffd\ufffd\ufffd\u0002\ufffd\u001e\ufffd\u000f\u0007q:\ufffd ~\ufffd\u0016\ufffdH\ufffd\ufffd\u0016\ufffd-\ufffd\ufffd\ufffd\u000e\ufffd\u0352\ufffdN\u0019XF\\c\ufffdH\u000f'\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 Q\ufffdNu\ufffd\ufffd\ufffd\ufffd\ufffd1+\\\ufffdf\f6\ufffd\ufffd`@BEX", "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\u0001\ufffd\ufffd\ufffd\u0002\ufffd\u001e\ufffd\u000f\u0007q:\ufffd ~\ufffd\u0016\ufffdH\ufffd\ufffd\u0016\ufffd-\ufffd\ufffd\ufffd\u000e\ufffd\u0352\ufffdN\u0019XF\\c\ufffdH\u000f'\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4840378f25dad1f9338712f1cedf3ec2e472729d", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\u0001\ufffd\ufffd\ufffd\u0002\ufffd\u001e\ufffd\u000f\u0007q:\ufffd ~\ufffd\u0016\ufffdH\ufffd\ufffd\u0016\ufffd-\ufffd\ufffd\ufffd\u000e\ufffd\u0352\ufffdN\u0019XF\\c\ufffdH\u000f'\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9073, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq:\ufffd ~\ufffd\ufffdH\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd\u0352\ufffdNXF\\c\ufffdH'\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9073 \u00b7 (reconnaissance)", "target_port_label": "9073 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9073, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\u0001\ufffd\ufffd\ufffd\u0002\ufffd\u001e\ufffd\u000f\u0007q:\ufffd ~\ufffd\u0016\ufffdH\ufffd\ufffd\u0016\ufffd-\ufffd\ufffd\ufffd\u000e\ufffd\u0352\ufffdN\u0019XF\\c\ufffdH\u000f'\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9073, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9073 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd$\ufffdu\u00dc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq:\ufffd ~\ufffd\ufffdH\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd\u0352\ufffdNXF\\c\ufffdH'\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "target_port_label": "9073 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9073" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.34, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "asn_dc_heuristic": true }
05/08/2026 16:28:06 UTC	TCP	9073	—	Scan de ports port scan syn · port 9073 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_fast Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9073 Chemin / cible — Payload %�Cookie: mstshash=test Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) %�Cookie: mstshash=test Meta JSON brut { "bytes_in": 42, "payload_entropy": 3.9214974820450146, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9073, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "09d777849f1a08fb59b72ae9c441b10f1ecf0e0f", "event_fingerprint": "f19ddf3b090c8173d49e0366b41034b75923b8cb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "86694eeca7d01319c2e510ca0cdb19fa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9073, "risk_score": 42 }, "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0e18e6df6027b15ac116beb731204eb3d150299", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9073 }, "evidence_snippet": "%\ufffdCookie: mstshash=test", "attack_vector": "port scan syn \u00b7 port 9073 \u00b7 (reconnaissance)", "target_port_label": "9073", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (237 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9073, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9073 }, "attack_vector": "port scan syn \u00b7 port 9073 \u00b7 (reconnaissance)", "evidence_snippet": "%\ufffdCookie: mstshash=test", "target_port_label": "9073", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9073" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8907, 8911, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003, 9004, 9009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.27, "multi_protocol_correlation": true, "multi_protocol_count": 237, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast" ], "asn_dc_heuristic": true }
05/08/2026 16:28:05 UTC	TCP	9069 · TLS	tls	Scan de ports port scan syn · via TLS:9069 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2079bcc000c9a54e Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9069 Chemin / cible — Service TLS Payload �LW��S��э$ou��ϓJ�"Cv�4��u�LΣ �p� # =�� Lh��V>=�S��~��+�/�,�0̨̩� �� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �LW��S��э$ou��ϓJ�"Cv�4��u�LΣ �p� #=�� Lh��V>=�S��~��+�/�,�0̨̩� �� Requête brute (extrait) �LW��S��э$ou��ϓJ�"Cv�4��u�LΣ �p� # =�� Lh��V>=�S��~��+�/�,�0̨̩� �� 2+3&$ �e�v 2�o2 �mFuݰXA�� Meta JSON brut { "tls_ja3_hash": "2079bcc000c9a54e0784733c0142d140", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 1, "bytes_in": 263, "payload_entropy": 5.647837298227135, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9069, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1718f032c2b31f9c06684921c8dde142ed03a9d0", "event_fingerprint": "c3f8380e9e31744bcb28d1e76347229ef771b17f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "2079bcc000c9a54e0784733c0142d140", "payload_hash": "44f821cfb11961ca9b14e7a5fdf14687", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9069, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003LW\ufffd\ufffd\ufffdS\u001a\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd \u0005#\u000b=\ufffd\ufffd Lh\ufffd\u001f\ufffd\ufffd\ufffdV>\u001f=\ufffdS\ufffd\ufffd~\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003LW\ufffd\ufffd\ufffdS\u001a\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd \u0005#\u000b=\ufffd\ufffd Lh\ufffd\u001f\ufffd\ufffd\ufffdV>\u001f=\ufffdS\ufffd\ufffd~\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001fe\ufffdv\n\u00052\u0011\ufffdo2\r\ufffdmFu\u0770X\u0004A\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003LW\ufffd\ufffd\ufffdS\u001a\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd \u0005#\u000b=\ufffd\ufffd Lh\ufffd\u001f\ufffd\ufffd\ufffdV>\u001f=\ufffdS\ufffd\ufffd~\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25b0e801b341a48b61272bc2ca75a92f6ba58b9f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003LW\ufffd\ufffd\ufffdS\u001a\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd \u0005#\u000b=\ufffd\ufffd Lh\ufffd\u001f\ufffd\ufffd\ufffdV>\u001f=\ufffdS\ufffd\ufffd~\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9069, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdLW\ufffd\ufffd\ufffdS\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd #=\ufffd\ufffd Lh\ufffd\ufffd\ufffd\ufffdV>=\ufffdS\ufffd\ufffd~\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9069 \u00b7 (reconnaissance)", "target_port_label": "9069 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (235 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9069, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003LW\ufffd\ufffd\ufffdS\u001a\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd \u0005#\u000b=\ufffd\ufffd Lh\ufffd\u001f\ufffd\ufffd\ufffdV>\u001f=\ufffdS\ufffd\ufffd~\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9069, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9069 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdLW\ufffd\ufffd\ufffdS\ufffd\ufffd\u044d$ou\ufffd\ufffd\u03d3J\ufffd\"Cv\ufffd4\ufffd\ufffdu\ufffdL\u03a3 \ufffdp\ufffd #=\ufffd\ufffd Lh\ufffd\ufffd\ufffd\ufffdV>=\ufffdS\ufffd\ufffd~\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "target_port_label": "9069 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9069" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 1.52, "multi_protocol_correlation": true, "multi_protocol_count": 235, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "asn_dc_heuristic": true }
05/08/2026 16:28:05 UTC	TCP	9069	—	Scan de ports port scan syn · port 9069 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_fast Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9069 Chemin / cible — Payload %�Cookie: mstshash=test Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) %�Cookie: mstshash=test Meta JSON brut { "bytes_in": 42, "payload_entropy": 3.9214974820450146, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9069, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "52ac4c051f0f64d9a529eb44e026f77fdcc010f9", "event_fingerprint": "0461de8cc182e32d3e5269b7484b618cb221c5b4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "86694eeca7d01319c2e510ca0cdb19fa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9069, "risk_score": 42 }, "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5bf22cc127e94ede8d7ba4fe951c791b107dc804", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9069 }, "evidence_snippet": "%\ufffdCookie: mstshash=test", "attack_vector": "port scan syn \u00b7 port 9069 \u00b7 (reconnaissance)", "target_port_label": "9069", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (236 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9069, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9069 }, "attack_vector": "port scan syn \u00b7 port 9069 \u00b7 (reconnaissance)", "evidence_snippet": "%\ufffdCookie: mstshash=test", "target_port_label": "9069", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9069" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 51, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 1.44, "multi_protocol_correlation": true, "multi_protocol_count": 236, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast" ], "asn_dc_heuristic": true }
05/08/2026 16:28:04 UTC	TCP	9068 · TLS	tls	Scan de ports port scan syn · via TLS:9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2079bcc000c9a54e Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Service TLS Payload �2��Ek�1\|�P��AC�#<�e�F� �=uJ~ "D(��N��ҲYe��Sыs��,x8�+�/�,�0̨̩� �� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �2��Ek�1\|�P��AC�#<�e�F� �=uJ~ "D(��N��ҲYe��Sыs��,x8�+�/�,�0̨̩� �� Requête brute (extrait) �2��Ek�1\|�P��AC�#<�e�F� �=uJ~ "D(��N��ҲYe��Sыs��,x8�+�/�,�0̨̩� �� 2+3&$ ��:N'�R� ��ݝs�̏Z Meta JSON brut { "tls_ja3_hash": "2079bcc000c9a54e0784733c0142d140", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 1, "bytes_in": 263, "payload_entropy": 5.796651858607121, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5ee32f45b680262b46caa5509ad59dae288a203d", "event_fingerprint": "0f6d160eadde2a8f3a4e0132647b7552beee0c01", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "2079bcc000c9a54e0784733c0142d140", "payload_hash": "3b0ce0d9bbffd6eb589a669689eabb9b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\ufffd\u0015Ek\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffd\u0018e\ufffdF\ufffd\t\ufffd=\u0017uJ~ \"D(\ufffd\ufffd\ufffd\bN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffd\u0017S\u044bs\ufffd\ufffd\u000f,\u0005\u0015x8\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\ufffd\u0015Ek\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffd\u0018e\ufffdF\ufffd\t\ufffd=\u0017uJ~ \"D(\ufffd\ufffd\ufffd\bN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffd\u0017S\u044bs\ufffd\ufffd\u000f,\u0005\u0015x8\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0010:N'\ufffdR\ufffd\u000b\ufffd\ufffd\u001a\ufffd\ufffd\u001e\ufffd\u075ds\ufffd\u030fZ", "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\ufffd\u0015Ek\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffd\u0018e\ufffdF\ufffd\t\ufffd=\u0017uJ~ \"D(\ufffd\ufffd\ufffd\bN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffd\u0017S\u044bs\ufffd\ufffd\u000f,\u0005\u0015x8\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff7491718261fd992b9657eb591aeec188fd550a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\ufffd\u0015Ek\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffd\u0018e\ufffdF\ufffd\t\ufffd=\u0017uJ~ \"D(\ufffd\ufffd\ufffd\bN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffd\u0017S\u044bs\ufffd\ufffd\u000f,\u0005\u0015x8\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9068, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd2\ufffd\ufffdEk\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffde\ufffdF\ufffd\t\ufffd=uJ~ \"D(\ufffd\ufffd\ufffdN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffdS\u044bs\ufffd\ufffd,x8\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9068 \u00b7 (reconnaissance)", "target_port_label": "9068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (234 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\ufffd\u0015Ek\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffd\u0018e\ufffdF\ufffd\t\ufffd=\u0017uJ~ \"D(\ufffd\ufffd\ufffd\bN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffd\u0017S\u044bs\ufffd\ufffd\u000f,\u0005\u0015x8\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9068, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9068 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd2\ufffd\ufffdEk\ufffd1\|\ufffdP\ufffd\ufffd\ufffdAC\ufffd#<\ufffde\ufffdF\ufffd\t\ufffd=uJ~ \"D(\ufffd\ufffd\ufffdN\ufffd\ufffd\u04b2Ye\ufffd\ufffd\ufffd\ufffd\ufffdS\u044bs\ufffd\ufffd,x8\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "target_port_label": "9068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 1.45, "multi_protocol_correlation": true, "multi_protocol_count": 234, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "asn_dc_heuristic": true }
05/08/2026 16:28:04 UTC	TCP	9068	—	Scan de ports port scan syn · port 9068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9068 Chemin / cible — Payload %�Cookie: mstshash=test Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) %�Cookie: mstshash=test Meta JSON brut { "bytes_in": 42, "payload_entropy": 3.9214974820450146, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4bada3a62ab8443f6cb2cb0abf8eaa7c5c819c1f", "event_fingerprint": "b1f56699e620259451ecad2b07deb292bf268f1f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "86694eeca7d01319c2e510ca0cdb19fa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9068, "risk_score": 42 }, "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6348dce0bea49e4b53208eab8b9ddb490c377be", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9068 }, "evidence_snippet": "%\ufffdCookie: mstshash=test", "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "target_port_label": "9068", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (235 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9068 }, "attack_vector": "port scan syn \u00b7 port 9068 \u00b7 (reconnaissance)", "evidence_snippet": "%\ufffdCookie: mstshash=test", "target_port_label": "9068", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 50, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 1.45, "multi_protocol_correlation": true, "multi_protocol_count": 235, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:03 UTC	TCP	9066 · TLS	tls	Scan de ports port scan syn · via TLS:9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2079bcc000c9a54e Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Service TLS Payload ��u�ݴ��%��8wl��Ńh��l�� A � A��?�`\&rw/X�P6�(�f�+�/�,�0̨̩� �� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��u�ݴ��%��8wl��Ńh��l�� A � A��?�`\&rw/X�P6�(�f�+�/�,�0̨̩� �� Requête brute (extrait) ��u�ݴ��%��8wl��Ńh��l�� A � A��?�`\&rw/X�P6�(�f�+�/�,�0̨̩� �� 2+3&$ >�ϧ-ALb��f��L Meta JSON brut { "tls_ja3_hash": "2079bcc000c9a54e0784733c0142d140", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 1, "bytes_in": 263, "payload_entropy": 5.658801212170593, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8660a811f6c4f79f753340b76611d09bac9d725b", "event_fingerprint": "4c493027c4ec21c2c02c539bdbc13c506f82a7e2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "2079bcc000c9a54e0784733c0142d140", "payload_hash": "10e2a5715eab977254a15eaa11eb096b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdu\ufffd\u0006\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8\u001dwl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\u000f\ufffd\ufffd\u001dA\n\ufffd A\u0012\ufffd\ufffd?\ufffd`\\&rw\/X\u0005\u0006\ufffdP\u00146\ufffd(\ufffdf\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdu\ufffd\u0006\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8\u001dwl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\u000f\ufffd\ufffd\u001dA\n\ufffd A\u0012\ufffd\ufffd?\ufffd`\\&rw\/X\u0005\u0006\ufffdP\u00146\ufffd(\ufffdf\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 >\u001b\ufffd\u03e7-ALb\u0006\ufffd\u0004\u001d\u0016\ufffdf\b\ufffd\ufffd\ufffd\ufffd\ufffdL\u0001", "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdu\ufffd\u0006\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8\u001dwl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\u000f\ufffd\ufffd\u001dA\n\ufffd A\u0012\ufffd\ufffd?\ufffd`\\&rw\/X\u0005\u0006\ufffdP\u00146\ufffd(\ufffdf\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4eb35a762fd4e86654475489e5d8e303819d497b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdu\ufffd\u0006\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8\u001dwl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\u000f\ufffd\ufffd\u001dA\n\ufffd A\u0012\ufffd\ufffd?\ufffd`\\&rw\/X\u0005\u0006\ufffdP\u00146\ufffd(\ufffdf\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdu\ufffd\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8wl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdA\n\ufffd A\ufffd\ufffd?\ufffd`\\&rw\/X\ufffdP6\ufffd(\ufffdf\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9066 \u00b7 (reconnaissance)", "target_port_label": "9066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (233 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdu\ufffd\u0006\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8\u001dwl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\u000f\ufffd\ufffd\u001dA\n\ufffd A\u0012\ufffd\ufffd?\ufffd`\\&rw\/X\u0005\u0006\ufffdP\u00146\ufffd(\ufffdf\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdu\ufffd\u0774\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd8wl\ufffd\ufffd\ufffd\u0143h\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdA\n\ufffd A\ufffd\ufffd?\ufffd`\\&rw\/X\ufffdP6\ufffd(\ufffdf\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "target_port_label": "9066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 49, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 1.44, "multi_protocol_correlation": true, "multi_protocol_count": 233, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "asn_dc_heuristic": true }
05/08/2026 16:28:03 UTC	TCP	9066	—	Scan de ports port scan syn · port 9066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9066 Chemin / cible — Payload %�Cookie: mstshash=test Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) %�Cookie: mstshash=test Meta JSON brut { "bytes_in": 42, "payload_entropy": 3.9214974820450146, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b58212efeee0410f2966d979b2bb1f52f8b5323b", "event_fingerprint": "c963151ce34a3813bd54c501980ca3dc8cc4afa3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "86694eeca7d01319c2e510ca0cdb19fa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9066, "risk_score": 42 }, "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8b25f07af3c4aecb588d67eaea0e8e567b9ce7fd", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9066 }, "evidence_snippet": "%\ufffdCookie: mstshash=test", "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "target_port_label": "9066", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (234 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9066 }, "attack_vector": "port scan syn \u00b7 port 9066 \u00b7 (reconnaissance)", "evidence_snippet": "%\ufffdCookie: mstshash=test", "target_port_label": "9066", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 49, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 1.43, "multi_protocol_correlation": true, "multi_protocol_count": 234, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:02 UTC	TCP	9058 · TLS	tls	Scan de ports port scan syn · via TLS:9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2079bcc000c9a54e Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_slow tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Service TLS Payload �@P��K7�13 g-��7�^j��Z�J��;GK ��Z��58�.�0V��@p��,��+�/�,�0̨̩� �� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �@P��K7�13g-��7�^j��Z�J��;GK ��Z��58�.�0V��@p��,��+�/�,�0̨̩� �� Requête brute (extrait) �@P��K7�13 g-��7�^j��Z�J��;GK ��Z��58�.�0V��@p��,��+�/�,�0̨̩� �� 2+3&$ ~�]��$8�z+��Q��D� 0�]v Meta JSON brut { "tls_ja3_hash": "2079bcc000c9a54e0784733c0142d140", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 1, "bytes_in": 263, "payload_entropy": 5.7664089599953305, "port_category": "registered", "org": "Google LLC", "service": "tls", "app_proto": "tls", "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2ca844a0e064a7c3cb2d1dfa98364064edc5ccf3", "event_fingerprint": "0c279de9bef62a7a94d975c8161ef1546050f8c3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "2079bcc000c9a54e0784733c0142d140", "payload_hash": "9e7cbe83afd7306eb3d705d2e80f708c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003@P\ufffd\ufffd\ufffdK7\ufffd13\fg-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd\u0013;GK \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\u001e\ufffd0V\ufffd\u001f\ufffd@p\u0010\ufffd\ufffd,\ufffd\u0010\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003@P\ufffd\ufffd\ufffdK7\ufffd13\fg-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd\u0013;GK \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\u001e\ufffd0V\ufffd\u001f\ufffd@p\u0010\ufffd\ufffd,\ufffd\u0010\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ~\ufffd]\ufffd\ufffd\ufffd\u001d$8\ufffdz+\ufffd\ufffdQ\ufffd\ufffd\ufffdD\ufffd\f0\ufffd]v", "payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003@P\ufffd\ufffd\ufffdK7\ufffd13\fg-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd\u0013;GK \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\u001e\ufffd0V\ufffd\u001f\ufffd@p\u0010\ufffd\ufffd,\ufffd\u0010\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f4197f573dc1a2d883a1d5320a657dcb3fc624fc", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003@P\ufffd\ufffd\ufffdK7\ufffd13\fg-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd\u0013;GK \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\u001e\ufffd0V\ufffd\u001f\ufffd@p\u0010\ufffd\ufffd,\ufffd\u0010\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9058, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd@P\ufffd\ufffd\ufffdK7\ufffd13g-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd;GK \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\ufffd0V\ufffd\ufffd@p\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:9058 \u00b7 (reconnaissance)", "target_port_label": "9058 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (233 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u0003@P\ufffd\ufffd\ufffdK7\ufffd13\fg-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd\u0013;GK \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\u001e\ufffd0V\ufffd\u001f\ufffd@p\u0010\ufffd\ufffd,\ufffd\u0010\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000", "tls_ja3": "2079bcc000c9a54e0784733c0142d140", "port": 9058, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:9058 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd@P\ufffd\ufffd\ufffdK7\ufffd13g-\ufffd\ufffd7\ufffd^j\ufffd\ufffdZ\ufffdJ\ufffd\ufffd\ufffd;G*K \ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd58\ufffd.\ufffd0V\ufffd\ufffd@p\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd", "target_port_label": "9058 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 49, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8910, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.2, "multi_protocol_correlation": true, "multi_protocol_count": 233, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow", "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "asn_dc_heuristic": true }
05/08/2026 16:28:02 UTC	TCP	9058	—	Scan de ports port scan syn · port 9058 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9058 Chemin / cible — Payload %�Cookie: mstshash=test Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) %�Cookie: mstshash=test Meta JSON brut { "bytes_in": 42, "payload_entropy": 3.9214974820450146, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9058, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "88a540759fb530e3889a0a5d0752b37bcf5c1593", "event_fingerprint": "634bd3a28e368cd0af959a22f749e796bcb84238", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "86694eeca7d01319c2e510ca0cdb19fa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9058, "risk_score": 42 }, "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a1fdda5063f1843050aa58e0ff26999790d67b0", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9058 }, "evidence_snippet": "%\ufffdCookie: mstshash=test", "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "target_port_label": "9058", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (234 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9058, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000", "port": 9058 }, "attack_vector": "port scan syn \u00b7 port 9058 \u00b7 (reconnaissance)", "evidence_snippet": "%\ufffdCookie: mstshash=test", "target_port_label": "9058", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9058" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 49, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8910, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.2, "multi_protocol_correlation": true, "multi_protocol_count": 234, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }
05/08/2026 16:28:01 UTC	TCP	9052	—	Scan de ports port scan syn · port 9052 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9052 Chemin / cible — Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Google LLC", "service": null, "app_proto": null, "asn": 396982, "country": "US", "dst_port": 9052, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "6b0cdcd6f6b1405b2e48c238b7ee9f4a4e5691cb", "event_fingerprint": "7bb2000e6035ed62cc5c7e8c853edabffc9c4c0c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9052, "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ae2293ecaedd5a2ed2e18c8fec2db517662bc3fa", "protocol_details": { "port": 9052 }, "attack_vector": "port scan syn \u00b7 port 9052 \u00b7 (reconnaissance)", "target_port_label": "9052", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (234 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 40, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9052, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "port": 9052 }, "attack_vector": "port scan syn \u00b7 port 9052 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "9052", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.68.34.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9052" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 49, "port_scan_ports_sample": [ 8888, 8889, 8906, 8907, 8911, 8912, 8915, 8916, 8935, 8988, 8990, 8993, 9000, 9001, 9002, 9003 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.32, "multi_protocol_correlation": true, "multi_protocol_count": 234, "multi_protocol_sample": [ "arangodb", "backup-scan-probe", "bitcoin", "cassandra", "clickhouse-native", "consul", "consul-server", "devops-probe" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "34.68.34.0\/24", "coordinated_ip_count": 12, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_slow" ], "asn_dc_heuristic": true }

34.68.34.69

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence