Renseignement sur les menaces

Allemagne

45.135.193.193

FAI Pfcloud UG (haftungsbeschrankt) Première vue 21/05/2026 00:49 UTC Dernière vue 20/07/2026 16:33 UTC Risque Moyen

Période analysée : 2026-04-21 → 2026-07-20

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 61/100 Moyen

Première observation 21/05/2026 00:49 UTC

Dernière observation 20/07/2026 16:33 UTC

Événements (période) 642

MITRE ATT&CK principal T1046 240 occurrences

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +18

Comparaison ASN / FAI

ASN 51396 · 45.135.193.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 642 événements sur la période pour cette IP.

176.65.148.250 http 20/07/2026 16:51 UTC
204.76.203.49 Sonde HTTP 20/07/2026 15:56 UTC
45.135.194.31 Scan vulnérabilités 20/07/2026 11:53 UTC
176.65.134.3 Sonde HTTP 20/07/2026 10:35 UTC
204.76.203.81 Sonde port 20/07/2026 10:17 UTC
176.65.149.182 Sonde HTTP 20/07/2026 09:12 UTC
176.65.148.132 minecraft probe 20/07/2026 08:16 UTC
176.65.148.29 litecoin probe 20/07/2026 04:37 UTC

Événements (filtres)

642

Première observation

21/05/2026 00:49 UTC

Dernière observation

20/07/2026 16:33 UTC

Dernière activité (filtres)

20/07/2026 16:33 UTC

Événements 7j

120

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 575 SAP ICM TCP 67

HTTP

575

SAP ICM

Géolocalisation

Origine réseau déclarée

Allemagne unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Pfcloud UG (haftungsbeschrankt) 216 Port 81 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443

Détails protocole

Méthode: CONNECT
Chemin: httpbin.org:443

Aperçu payload

CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive

Port / service

8888 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 4 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +18

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

642 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

642 événement(s) — page 1/13

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/07/2026 16:33:57 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:33:57 UTC	TCP	8081 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8081 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e95161fd34f19455690a7ffe62f614458438153a", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:33:57 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +4 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a4efa3e28900c8259739991fac33f785e2a63d3", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +4", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +4", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "behavior_alerts": [ "rapid_port_scan" ], "correlation_confidence_boost": 4, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:33:57 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "651043888512ffdd8ee2c8a504c2dd6bc71fc879", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8000, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 16:33:57 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99a5f0790a8a0e12ba6e5104588d291c2466f748", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:33:57 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:16:41 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:16:41 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4507a484b7e1aa928688d44c1b8dd410dce0ea85", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:16:41 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +4 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +4", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +4", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "behavior_alerts": [ "rapid_port_scan" ], "correlation_confidence_boost": 4, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:16:41 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a4efa3e28900c8259739991fac33f785e2a63d3", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 16:16:41 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "651043888512ffdd8ee2c8a504c2dd6bc71fc879", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 16:16:41 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 14:20:16 UTC	TCP	8000 · SAP ICM	sap-icm	Flood / DDoS http flood · via SAP ICM:8000 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 46 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60c4c67785c5e2577d302301aa6bc8c897facd0b", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 14:20:16 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 14:20:16 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a4efa3e28900c8259739991fac33f785e2a63d3", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 14:20:16 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8000, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 14:20:16 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99a5f0790a8a0e12ba6e5104588d291c2466f748", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 14:20:16 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 12:29:41 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 12:29:41 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4507a484b7e1aa928688d44c1b8dd410dce0ea85", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 12:29:41 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "651043888512ffdd8ee2c8a504c2dd6bc71fc879", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 12:29:41 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a4efa3e28900c8259739991fac33f785e2a63d3", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8000, 8080 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 12:29:41 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 12:29:41 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 10:31:19 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 10:31:19 UTC	TCP	8000 · SAP ICM	sap-icm	Flood / DDoS http flood · via SAP ICM:8000 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 46 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60c4c67785c5e2577d302301aa6bc8c897facd0b", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 10:31:19 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a4efa3e28900c8259739991fac33f785e2a63d3", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 10:31:19 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8000, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 10:31:19 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99a5f0790a8a0e12ba6e5104588d291c2466f748", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 10:31:19 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 05:35:51 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 05:35:51 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e7ba4132d994ca804d4fcaba9aec72c8a1a91fe0", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 05:35:51 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "651043888512ffdd8ee2c8a504c2dd6bc71fc879", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 05:35:51 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8000, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 05:35:51 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 05:35:51 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99a5f0790a8a0e12ba6e5104588d291c2466f748", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
19/07/2026 13:07:03 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
19/07/2026 13:07:03 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e7ba4132d994ca804d4fcaba9aec72c8a1a91fe0", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
19/07/2026 13:07:03 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +4 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99a5f0790a8a0e12ba6e5104588d291c2466f748", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +4", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +4", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "behavior_alerts": [ "rapid_port_scan" ], "correlation_confidence_boost": 4, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
19/07/2026 13:07:03 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
19/07/2026 13:07:03 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "651043888512ffdd8ee2c8a504c2dd6bc71fc879", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
19/07/2026 13:07:03 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 17:56:57 UTC	TCP	81 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:81 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "well_known", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 81, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "ce07fb734aa6a7b9afc0a03b79b00ff519ee8940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dccd1515762b165b997ddc67956e20f261f2b2a6", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 17:56:57 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "1952b8c0f599cd243e237b8787aa6921301e769c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4507a484b7e1aa928688d44c1b8dd410dce0ea85", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 17:56:57 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +4 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc69507e76d7bcc2ea9a92af07c0780a95a84406", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 4 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +4", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +4", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "behavior_alerts": [ "rapid_port_scan" ], "correlation_confidence_boost": 4, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 17:56:57 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a4efa3e28900c8259739991fac33f785e2a63d3", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 3128, 8080, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 17:56:57 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "sap-icm", "app_proto": "sap-icm", "asn": 51396, "country": "DE", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "651043888512ffdd8ee2c8a504c2dd6bc71fc879", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
18/07/2026 17:56:57 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → httpbin.org:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5b4b9af3af0c9d1d568124e688acfcb21e583897", "event_fingerprint": "6876e919b02241e2b92f6033fbcc273a894766b7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d74f01707f9804757b8e6faca440218771350e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 3128, 8000, 8080, 8081, 8888 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "sap-icm" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 07:39:07 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → httpbin.org:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "da92a5499aace137740a191f890030910bd3e463", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e7ba4132d994ca804d4fcaba9aec72c8a1a91fe0", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
18/07/2026 07:39:07 UTC	TCP	8888 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8888 · (sonde / probe) · → httpbin.org:443	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT httpbin.org:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT httpbin.org:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible httpbin.org:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 35% Confiance classification 35% Confiance modérée — signal unique Risque capteur Faible · 38 Confiance : Confiance 35 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0599 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT httpbin.org:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_target_hash": "af681cf0ed88a1d30399c294bee7161534aedef7", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.898164577102264, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "DE", "dst_port": 8888, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842", "event_fingerprint": "63b84caa06855a90a85bbd44b4f41cbb020ab5d4", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%", "confidence": 0.35, "classification_confidence": 0.35, "precision_score": 42, "precision_signals": [ "pat-0599" ], "kb_rule_ids": [ "pat-0599" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 35, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0440e4d09bd26658b1948c8fa0329712", "path_pattern_hash": "ace3352d3d453073e14fd013b2b0a99c" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "evidence": { "method": "CONNECT", "path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "request_sample": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n", "payload_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0e25243908dc2bc6514b0f7e8bfb1358098c9b4e", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 35 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 35, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "pat-0599" ], "tags_summary_labels_fr": [ "pat-0599" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "CONNECT", "http_path": "httpbin.org:443", "request_line": "CONNECT httpbin.org:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 httpbin.org:443", "evidence_snippet": "CONNECT httpbin.org:443 HTTP\/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 35 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 35 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }

45.135.193.193

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence