|
|
TCP |
5064 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5064 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 3b2bd66322b37fde
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
� ���b��+�u�H�c%�O� �B�Ž`� �< G�-�h�2갘��a�+��&���i�db� ���+�/�,�0̨̩�� � � / 5 s�� � � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���b��+�u�H�c%�O� �B�Ž`�
�< G�-�h�2갘��a�+��&���i�db� ���+�/�,�0̨̩�� � � / 5 s�� �
� �
Requête brute (extrait)
� ���b��+�u�H�c%�O� �B�Ž`� �< G�-�h�2갘��a�+��&���i�db� ���+�/�,�0̨̩�� � � / 5 s�� � � � ��m��5�~�H[%i0� N;�b��Gr�+CO O# ВR���s���@;��&)u�-"������q�PN��.� rMl���IJp�v�g�y� *��k@hl��npU��_P��;P zfs���<l7t�
Meta JSON brut
{
"tls_ja3_hash": "3b2bd66322b37fde2a4c604fc5b3bdcd",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1765,
"payload_entropy": 7.774977057351711,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "c0586e7835ebfa9103d14b97bce73898467f51c9",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3b2bd66322b37fde2a4c604fc5b3bdcd",
"payload_hash": "3dec7250a45680bfea0cedad93cd7dde",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffdm\ufffd\ufffd5\ufffd~\ufffdH[%i0\ufffd\nN;\u0011\ufffdb\ufffd\ufffdGr\ufffd+CO\u001cO#\u0000\u0412R\ufffd\ufffd\u000f\ufffds\ufffd\ufffd\b\ufffd@;\ufffd\ufffd&)u\ufffd-\"\ufffd\ufffd\ufffd\b\ufffd\u0002\u0018\ufffd\ufffdq\ufffdPN\ufffd\ufffd.\ufffd\u0000rMl\ufffd\ufffd\ufffd\u0132p\ufffdv\ufffdg\ufffdy\ufffd\t*\ufffd\ufffdk@\u0014hl\ufffd\ufffdnpU\ufffd\ufffd_\u001aP\ufffd\ufffd;P\u001ezfs\ufffd\ufffd\u0019\ufffd<l7t\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffdm\ufffd\ufffd5\ufffd~\ufffdH[%i0\ufffd\nN;\u0011\ufffdb\ufffd\ufffdGr\ufffd+CO\u001cO#\u0000\u0412R\ufffd\ufffd\u000f\ufffds\ufffd\ufffd\b\ufffd@;\ufffd\ufffd&)u\ufffd-\"\ufffd\ufffd\ufffd\b\ufffd\u0002\u0018\ufffd\ufffdq\ufffdPN\ufffd\ufffd.\ufffd\u0000rMl\ufffd\ufffd\ufffd\u0132p\ufffdv\ufffdg\ufffdy\ufffd\t*\ufffd\ufffdk@\u0014hl\ufffd\ufffdnpU\ufffd\ufffd_\u001aP\ufffd\ufffd;P\u001ezfs\ufffd\ufffd\u0019\ufffd<l7t\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e939c053239537573ed8bdeec007bdfa64041959",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"tls_ja3": "3b2bd66322b37fde2a4c604fc5b3bdcd",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd+\ufffdu\ufffdH\ufffdc%\ufffdO\ufffd\ufffdB\ufffd\u017d`\ufffd\n\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd+\ufffd\ufffd&\ufffd\ufffd\ufffdi\ufffddb\ufffd\ud8cc\udf84 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s\ufffd\ufffd\ufffd\r\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:5064 \u00b7 (sonde \/ probe)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"tls_ja3": "3b2bd66322b37fde2a4c604fc5b3bdcd",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5064 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd+\ufffdu\ufffdH\ufffdc%\ufffdO\ufffd\ufffdB\ufffd\u017d`\ufffd\n\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd+\ufffd\ufffd&\ufffd\ufffd\ufffdi\ufffddb\ufffd\ud8cc\udf84 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s\ufffd\ufffd\ufffd\r\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5069 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:5069 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 6875a1bf76f65886
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5069
Chemin / cible
—
Service
TLS
Payload
�_�h�~%%]��f��g�l}X�Mo�?��f� 9X �8��Q����J���v|��^�[~V��@ jj�+�/�,�0̨̩�� � � / 5 ��� ��c�
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�_�h�~%%]��f��g�l}X�Mo�?��f� 9X �8��Q����J���v|��^�[~V��@ jj�+�/�,�0̨̩�� � � / 5 ���
��c�
Requête brute (extrait)
�_�h�~%%]��f��g�l}X�Mo�?��f� 9X �8��Q����J���v|��^�[~V��@ jj�+�/�,�0̨̩�� � � / 5 ��� ��c� � + �� 3���� c���jԆ���F���u�U)�H�$�"H� J�����k�<D T������Sɇ�
Meta JSON brut
{
"tls_ja3_hash": "6875a1bf76f6588692083c8648c8a881",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1797,
"payload_entropy": 7.770475273694821,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5069,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b120e6ec3a3ccf152c018c0c2baae2dd8c90f482",
"event_fingerprint": "451d5b5feea039ebba05ef83c7c590ede56b265b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "6875a1bf76f6588692083c8648c8a881",
"payload_hash": "f514743e58736456942b399aa2db4901",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5069,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u001b\u0000\u0003\u0002\u0000\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\ufffd\ufffd\u0000\u0001\u0000c\ufffd\u0004\ufffd\ufffd\u0013j\b\u0506\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u0006u\u0012\ufffdU\u000f)\u000e\ufffdH\ufffd$\u000f\ufffd\"H\ufffd\f\u0002J\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd<D\rT\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\ufffdS\u0012\u0247\u001b\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b12421dba82e1ea544fdf659f937dc441a7418cb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
"tls_ja3": "6875a1bf76f6588692083c8648c8a881",
"port": 5069,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffdg\ufffdl}X\ufffdMo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv|\ufffd\ufffd^\ufffd[~V\ufffd\ufffd@ jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\n\n\ufffd\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)",
"target_port_label": "5069 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5069,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
"tls_ja3": "6875a1bf76f6588692083c8648c8a881",
"port": 5069,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffdg\ufffdl}X\ufffdMo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv|\ufffd\ufffd^\ufffd[~V\ufffd\ufffd@ jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\n\n\ufffd\ufffdc\ufffd",
"target_port_label": "5069 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5093
|
—
|
Sonde port
Sonde port · port 5093 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5093
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 5093,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1bbd7acf1bbbc8b779dc61786182fa026bbef483",
"event_fingerprint": "a7c2aeba5c2161a393b6f81d935f0190c532b954",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5093,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82adc64d22eee6fcc15e7d1dd317e7d6f6831a87",
"protocol_details": {
"port": 5093
},
"attack_vector": "Sonde port \u00b7 port 5093 \u00b7 (sonde \/ probe)",
"target_port_label": "5093",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5093,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5093
},
"attack_vector": "Sonde port \u00b7 port 5093 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5093",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
5081 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5081 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b7f5c2c88bfdeae8
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5081
Chemin / cible
—
Service
TLS
Payload
� �� �� E�NZ�����預ܙ�!'�m�K�3� =Ȱ���;��3�Y�kͲ�b���3�7� JJ�+�/�,�0̨̩�� � � / 5 s** #
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��
�� E�NZ�����預ܙ�!'�m�K�3� =Ȱ���;��3�Y�kͲ�b���3�7� JJ�+�/�,�0̨̩�� � � / 5 s** #
Requête brute (extrait)
� �� �� E�NZ�����預ܙ�!'�m�K�3� =Ȱ���;��3�Y�kͲ�b���3�7� JJ�+�/�,�0̨̩�� � � / 5 s** # � � � ]̪,!�Q����0J#������h�Zio��O3 �sV�����_���+%�λ��s=C6�"��- �l #�d@"����h���iB�ɯ � 1��3�� ���~�r���
Meta JSON brut
{
"tls_ja3_hash": "b7f5c2c88bfdeae8fe66203e320ba05c",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1765,
"payload_entropy": 7.759354854756302,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "20e7c9891938ecc742976665720f48e9cacce874",
"event_fingerprint": "a572ee187c2bf5fb4bbc3e494dc2cf7469999bd0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "b7f5c2c88bfdeae8fe66203e320ba05c",
"payload_hash": "b0f032173f1eef906ca5bc3d73460643",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5081,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 ]\u032a\u0001,!\ufffdQ\ufffd\ufffd\ufffd\ufffd0J#\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffdh\u0011\ufffdZio\ufffd\ufffdO3\u0000\ufffds\u0016V\ufffd\ufffd\u0011\ufffd\ufffd\ufffd_\ufffd\u0080\ufffd\ufffd\u0003+%\ufffd\u03bb\ufffd\ufffds=C\u00066\ufffd\u0016\u07bd\"\ufffd\ufffd-\u0000\u0011\ufffdl\u001c#\ufffd\u0003d\u0010@\"\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdiB\ufffd\u026f\u0006\t\ufffd\u001f1\ufffd\ufffd3\ufffd\ufffd\n\ufffd\ufffd\ufffd~\ufffdr\u000e\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e37024c090d370a7b6a44636420c908c2fd3f7a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
"tls_ja3": "b7f5c2c88bfdeae8fe66203e320ba05c",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\n\ufffd\ufffdE\ufffdNZ\ufffd\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffdK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd3\ufffdY\ufffdk\u0372\ufffdb\ufffd\ufffd\ufffd3\ufffd7\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s**#",
"attack_vector": "tls probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5081,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
"tls_ja3": "b7f5c2c88bfdeae8fe66203e320ba05c",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\n\ufffd\ufffdE\ufffdNZ\ufffd\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffdK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd3\ufffdY\ufffdk\u0372\ufffdb\ufffd\ufffd\ufffd3\ufffd7\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s**#",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5002 · UPNP SSL
|
upnp-ssl
|
upnp-ssl
upnp-ssl · via UPNP SSL:5002 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
UPNP-SSL
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5002
Chemin / cible
—
Service
UPNP SSL
Payload
�g��Ro�2���& �+����\����&����� ��L:�,cZ7o'�˧ �\�|��O� ���7� ���+�/�,�0̨̩�� � � / 5 �::
Pourquoi cette classification : Type « upnp-ssl » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0607
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�g��Ro�2���& �+����\����&����� ��L:�,cZ7o'�˧ �\�|��O� ���7� ���+�/�,�0̨̩�� � � / 5 �::
Requête brute (extrait)
�g��Ro�2���& �+����\����&����� ��L:�,cZ7o'�˧ �\�|��O� ���7� ���+�/�,�0̨̩�� � � / 5 �:: � 3��JJ c��Բ*��ǻٗ U0B�C?wN�RB���yҾ������]X,��LRt)l�e��h`�2 �h���1Y �� �S�`3��茾��t�$K0:7!��ٴE���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f73736c20726561647920706f72743d353030320d0a",
"emulator_response_len": 39,
"bytes_in": 1797,
"payload_entropy": 7.741912163785317,
"port_category": "registered",
"org": "Google LLC",
"service": "upnp-ssl",
"app_proto": "upnp-ssl",
"asn": 396982,
"country": "US",
"dst_port": 5002,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "635244ab8fe14803de4ee902481371fdc394b70a",
"event_fingerprint": "78838bed4de0be42bda35b043c5f75aeb5745302",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0607"
],
"classification_reason": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "upnp-ssl",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4b3ec9c3e38a7510714d944c2c8a407c",
"path_pattern_hash": "28dfe76216994f641aeccc82eb9dae0e"
},
"target_context": {
"dst_port": 5002,
"service": "upnp-ssl",
"service_name": "upnp-ssl",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdJJ\u0000\u0001\u0000c\ufffd\u0004\ufffd\u0532*\ufffd\ufffd\u01fb\u0657\n\u0002U0B\ufffdC\u0003?wN\ufffdR\u0007B\ufffd\ufffd\ufffdy\u04be\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd]X,\ufffd\ufffdLRt)l\ufffde\ufffd\ufffdh`\ufffd2\u001c\ufffdh\ufffd\u0016\ufffd\u0019\ufffd\u00011Y\n\ufffd\u0005\ufffd\u0000\u070e\ufffdS\ufffd`3\ufffd\ufffd\u833e\ufffd\ufffdt\ufffd$K0:7!\ufffd\ufffd\u0674E\ufffd\ufffd\u0006\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
"classification_reason": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7aa7e6349c297e9511bb3643e2bb3694be78777f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
"port": 5002,
"service": "upnp-ssl",
"service_label_fr": "UPNP SSL"
},
"evidence_snippet": "\ufffdg\ufffd\ufffdRo\ufffd2\ufffd\ufffd\ufffd&\ufffd+\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\\\ufffd|\ufffd\ufffdO\ufffd\t\ufffd\ufffd\ufffd7\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::",
"attack_vector": "upnp-ssl \u00b7 via UPNP SSL:5002 \u00b7 (sonde \/ probe)",
"target_port_label": "5002 \u00b7 UPNP SSL",
"emulator_service": "upnp-ssl",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "upnp-ssl",
"service_label_fr": "UPNP SSL",
"dst_port": 5002,
"protocol_emulated": true,
"tags_summary": [
"pat-0607"
],
"tags_summary_labels_fr": [
"pat-0607"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-ssl",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
"port": 5002,
"service": "upnp-ssl",
"service_label_fr": "UPNP SSL"
},
"attack_vector": "upnp-ssl \u00b7 via UPNP SSL:5002 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdg\ufffd\ufffdRo\ufffd2\ufffd\ufffd\ufffd&\ufffd+\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\\\ufffd|\ufffd\ufffdO\ufffd\t\ufffd\ufffd\ufffd7\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::",
"target_port_label": "5002 \u00b7 UPNP SSL",
"emulator_service": "upnp-ssl",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_ssl",
"service_banner": "honeypot-upnp-ssl",
"service_os": "linux",
"dst_port": "5002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|