Détails IP 35.200.161.92

Synthèse exécutive

Profil de menace

Score de risque 45/100 Moyen

Première observation 02/08/2026 19:11 UTC

Dernière observation 02/08/2026 19:11 UTC

Événements (période) 19

MITRE ATT&CK principal TA0007 19 occurrences

Activité suspecte · risque 45/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « docker_tls_probe » (signaux protocolaires) · confiance 62%

Confiance 62 % — Score WAF 8

Comparaison ASN / FAI

ASN 396982 · 35.200.160.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 19 événements sur la période pour cette IP.

198.235.24.100 Sonde port 22/TCP 04/08/2026 23:37 UTC
205.210.31.211 Sonde MongoDB 04/08/2026 23:36 UTC
147.185.133.197 Scanner web 04/08/2026 23:34 UTC
35.203.211.167 Scanner web 04/08/2026 23:33 UTC
147.185.133.194 Scanner web 04/08/2026 23:31 UTC
35.241.211.215 Sonde SMB 04/08/2026 23:31 UTC
147.185.132.48 Sonde PostgreSQL 04/08/2026 23:31 UTC
147.185.133.105 Scanner web 04/08/2026 23:29 UTC

Événements (filtres)

Première observation

02/08/2026 19:11 UTC

Dernière observation

02/08/2026 19:11 UTC

Dernière activité (filtres)

02/08/2026 19:11 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

Inde unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Google LLC 0 Port 2376 docker_tls_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

docker tls probe · via DOCKER TLS:2376 · (sonde / probe)

Détails protocole

Aperçu payload

GET /env HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:2376

Port / service

2376 · DOCKER TLS

Service émulé

DOCKER-TLS

Raison confiance

Confiance 62 % — 5 signal(aux) capteur

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

Docker Tls Upstream

Confiance

62%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

19 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

19 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.bak HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.bak HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 95, "payload_entropy": 4.934337093938369, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c2da4f85efd53813f2bb0ae1bf3906e8", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "35c7bedef483c032e0d5c037bd999e975de121ba", "protocol_details": { "payload_preview": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.old HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.old HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 95, "payload_entropy": 4.939497357050717, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "35cc469d60fb51fc68b59c44bd2b367d", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "745b17a0d082c53dfaef2b65b7cb8f1d131bb67a", "protocol_details": { "payload_preview": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.old HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.save HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.save HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 96, "payload_entropy": 4.889534575562744, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "44bc574bfe94510be1373f2a39bd49b8", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5ab4741bb0b31a50de5a95eb128de4e16e8e80c", "protocol_details": { "payload_preview": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.save HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.backup HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.backup HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 98, "payload_entropy": 4.947625569959142, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fa32c9a31edf162d2df4a23b7db1bb46", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a990015a0d0fd1b6cb841f2d0324727d484f7e7", "protocol_details": { "payload_preview": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.backup HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.production HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.production HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 102, "payload_entropy": 4.9466480782523945, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "55bf04f721fc1c91d495bf50f786d9f2", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8000f633474cd06212206e2363899be33af38246", "protocol_details": { "payload_preview": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.production HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.dev HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.dev HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 95, "payload_entropy": 4.903846599704266, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a82312d362dc9d925c4cd88ec3a69bf8", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f08a56ca82a5809ba2122a993ef2acbcbf76a6c1", "protocol_details": { "payload_preview": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.dev HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.example HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.example HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 99, "payload_entropy": 4.9741598133829665, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "843f3992d75764c7f91a85408b86f371", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7fe62121636e27130b176f711d1c554bd1420b99", "protocol_details": { "payload_preview": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.example HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /actuator/env HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /actuator/env HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 99, "payload_entropy": 4.891361965124774, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 6, "anomaly_count": 0, "campaign_key": "80934d746b4ca35c10c033070f2faa28f6959b43", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3f3f9267254a3cad960cda96c161ee31", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcd5137ca97bfe6a199cdbe20607f4308d9f8962", "protocol_details": { "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/actuator\/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe", "tor_exit_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.local HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.local HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 97, "payload_entropy": 4.936260688916048, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c2906e340b68b6108b7fea8dc4db950", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fbec5cf33a66747fc6f5dd6374503a225e268059", "protocol_details": { "payload_preview": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.local HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /_ignition/health-check HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /_ignition/health-check HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 109, "payload_entropy": 5.0084336755563585, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1d369370a3729839dc3106b9cc71c125", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "58eed9e3ccf5e217ccc26bc045da5e158b841414", "protocol_details": { "payload_preview": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/_ignition\/health-check HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /wp-config.php~ HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /wp-config.php~ HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 101, "payload_entropy": 5.026110592735404, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 6, "anomaly_count": 0, "campaign_key": "72260d4625a810972382850e26394a8badbc24a0", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cb820feaaa7604293905e8c2e33d1b93", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "97ea18e597e04f6cc3124aa12b7876ef70864a81", "protocol_details": { "payload_preview": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/wp-config.php~ HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe", "redis_config_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /actuator/configprops HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 7 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /actuator/configprops HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 107, "payload_entropy": 4.9399021339953, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 7, "anomaly_count": 0, "campaign_key": "0a255f689dfac7078c0217184b1b4abfb93debf2", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ba32936ec5708f8cf6351d46cc34d7a6", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e86d0b33d0a801e97e859b6b7324c282282cb992", "protocol_details": { "payload_preview": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 7 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/actuator\/configprops HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 7 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe", "redis_config_probe", "tor_exit_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /crusader-404-probe HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /crusader-404-probe HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 105, "payload_entropy": 4.936918171331536, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bd5f701f1507a847f4f2c515b46566bd", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed7b35e118bc0dcbad4a02100c80270461aee07c", "protocol_details": { "payload_preview": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/crusader-404-probe HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /storage/logs/laravel.log HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /storage/logs/laravel.log HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 111, "payload_entropy": 4.9012162375171195, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 6, "anomaly_count": 0, "campaign_key": "80934d746b4ca35c10c033070f2faa28f6959b43", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a81515bb1087e952a2f5899e0782ae81", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7916c3e859da3c674bb87d575162d95208a9b876", "protocol_details": { "payload_preview": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe", "tor_exit_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	Sonde port 2376/TCP port 2376 tcp · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Preuve honeypot — Sonde port 2376/TCP Connexion détectée sur le port 2376 (TCP) du capteur simulé. Service DOCKER TLS Payload GET /wp-config.php.bak HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « port_2376_tcp » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 41 Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0160 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 933111 User-Agent — Règles WAF — Payload (extrait) GET /wp-config.php.bak HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 104, "payload_entropy": 5.025160758145247, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 41, "tag_count": 6, "anomaly_count": 0, "campaign_key": "72260d4625a810972382850e26394a8badbc24a0", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 70, "precision_signals": [ "pat-0160" ], "kb_rule_ids": [ "pat-0160" ], "matched_patterns": [ "pat-0160" ], "matched_pattern_names": [ "CRS 933111" ], "pattern_ids": [ "pat-0160" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 41 }, "named_classification_skipped": true, "named_candidate": "php_injection", "service_name": "docker-tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c02e024e10ac3821f2ee59e5bd700bb", "path_pattern_hash": "9aba6bc434f3c8513e1ae1bd3783caf2" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 41 }, "payload_preview": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e44db3bebc4c408df98ccee2f94d0d3e0cda9c2f", "protocol_details": { "payload_preview": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "port 2376 tcp \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 41 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "pat-0160" ], "tags_summary_labels_fr": [ "pat-0160" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "port 2376 tcp \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe", "redis_config_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	Sonde port 2376/TCP port 2376 tcp · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Preuve honeypot — Sonde port 2376/TCP Connexion détectée sur le port 2376 (TCP) du capteur simulé. Service DOCKER TLS Payload GET /wp-config.php.swp HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « port_2376_tcp » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 41 Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0160 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 933111 User-Agent — Règles WAF — Payload (extrait) GET /wp-config.php.swp HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 104, "payload_entropy": 4.983194142985629, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 41, "tag_count": 6, "anomaly_count": 0, "campaign_key": "72260d4625a810972382850e26394a8badbc24a0", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 70, "precision_signals": [ "pat-0160" ], "kb_rule_ids": [ "pat-0160" ], "matched_patterns": [ "pat-0160" ], "matched_pattern_names": [ "CRS 933111" ], "pattern_ids": [ "pat-0160" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 41 }, "named_classification_skipped": true, "named_candidate": "php_injection", "service_name": "docker-tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2c78c918a5debba8a27fe9b87a64635", "path_pattern_hash": "9aba6bc434f3c8513e1ae1bd3783caf2" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 41 }, "payload_preview": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "92f9e5b1a24cb61cc5f14c44ea60524ab3d7b91a", "protocol_details": { "payload_preview": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "port 2376 tcp \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_2376_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 41 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "pat-0160" ], "tags_summary_labels_fr": [ "pat-0160" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "port 2376 tcp \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/wp-config.php.swp HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe", "redis_config_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env.prod HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env.prod HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 96, "payload_entropy": 4.910127413205409, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "331c3f2a46ccf4ec582599ea11e8df11", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eb8030d9035224a20ab63787de694484462334ff", "protocol_details": { "payload_preview": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env.prod HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:26 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /env HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /env HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 90, "payload_entropy": 4.913105292001986, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "981f8d22821addf2db4ed4002d8ce5fe", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8000a4ef87602b6d87aa7f6cbd9d82fd6a3563c9", "protocol_details": { "payload_preview": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }
02/08/2026 19:11:25 UTC	TCP	2376 · DOCKER TLS	docker-tls	docker tls probe docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload GET /.env HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62% Confiance classification 62% Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env HTTP/1.1 accept: / user-agent: crusader-worker/1.0 host: 62.3.50.33:2376 Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 91, "payload_entropy": 4.9035370916340595, "port_category": "registered", "org": "Google LLC", "service": "docker-tls", "app_proto": "docker-tls", "asn": 396982, "country": "IN", "dst_port": 2376, "risk_waf": 8, "risk_classification": 44, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7", "event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 69, "precision_signals": [ "INT-docker-tls", "INT-upstream" ], "kb_rule_ids": [ "INT-docker-tls", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "docker-tls", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "IN", "asn": 396982, "org": "Google LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d73e5e16bb5c92b1c3ae0fa01f144596", "path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae" }, "target_context": { "dst_port": 2376, "service": "docker-tls", "service_name": "docker-tls", "risk_score": 45 }, "payload_preview": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "request_sample": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "evidence": { "request_sample": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376\r\n\r\n", "payload_snippet": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c7f6fc5ac6b6282511b30fd6fccc94321981840", "protocol_details": { "payload_preview": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "evidence_snippet": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 44, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "docker-tls", "service_label_fr": "DOCKER TLS", "dst_port": 2376, "protocol_emulated": true, "tags_summary": [ "INT-docker-tls", "INT-upstream" ], "tags_summary_labels_fr": [ "Docker Tls", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-docker-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "port": 2376, "service": "docker-tls", "service_label_fr": "DOCKER TLS" }, "attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env HTTP\/1.1\r\naccept: \/\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:2376", "target_port_label": "2376 \u00b7 DOCKER TLS", "emulator_service": "docker-tls", "confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker_tls", "service_banner": "honeypot-docker-tls", "service_os": "linux", "dst_port": "2376" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_tls_emulated", "docker_tls_payload", "http_get_probe", "net_docker_tls_probe" ], "asn_dc_heuristic": true }

35.200.161.92

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence