|
|
TCP |
18419 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
18419
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.193278977317785,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 18419,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323",
"event_fingerprint": "181b2f7cf1cc349ba18d16781f9a63f9d9459ef9",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b788cd5a77ac1dc1d18eff2069a27a0",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 18419,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b702553a43d39ff0e4b2611cc4d31782fd1823e7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 18419,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "18419 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18419,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 18419,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "18419 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18419"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
9169 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9169 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9169
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.185951690356521,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9169,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "96a23576b1606ebdbd15d82f203c4cec35408ad9",
"event_fingerprint": "a73d56677f337e2689cc6afa465071c2258873a5",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "604396e37827b5c6f3b37d8836c8e7a1",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 9169,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed8d92feca971fc44f36b245492b76043b678902",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 9169,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9169 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "9169 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9169,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 9169,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9169 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "9169 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9169"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
20648 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
20648
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 20648,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e",
"event_fingerprint": "cb7ee8010bf6e8b0337fcdd6bc02b81384ea4244",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 20648,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77345b93401a0ed45458496b234649e707309b5f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20648,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20648"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
20648 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
20648
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.279195101236418,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 20648,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e",
"event_fingerprint": "cb7ee8010bf6e8b0337fcdd6bc02b81384ea4244",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ad65ea09d79074efb8828d7161a3196",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 20648,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c00f608ce060a34a82649fc111f6ee5ae85233f6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20648,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20648"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
20648 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
20648
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cTFxMXExOnExcTFxMQ==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.138966151283639,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 20648,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e",
"event_fingerprint": "cb7ee8010bf6e8b0337fcdd6bc02b81384ea4244",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70b2a938a0e44ad85f7ecbce3c1696e4",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 20648,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "176fa6e12060dcc7fa953fe0f992e8cfa5e81883",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20648,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20648"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "d2d5673af5f6164be53064c5fe3b0e42c3b9a7de",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84b872b7f750fdf20576f7989312e465ec912f75",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic M3Byb3h5Og==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.067208660547247,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "d2d5673af5f6164be53064c5fe3b0e42c3b9a7de",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "849dbe7f24b7671177ac316117145dd1",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c1bd6d0dbe29534ddddd44f9eca07eea4c224f5",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic c2FjaGluOnNhY2hpbg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.290941445555632,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "d2d5673af5f6164be53064c5fe3b0e42c3b9a7de",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "202f8795487aec32c9e1669099318bc0",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aab298f7e475f53145b62875d454dbed85166218",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427
|
—
|
Sonde port
Sonde port · port 5427 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5427
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a4be75a32a56e771b2ef236766d8b14a2ff13a8f",
"event_fingerprint": "a1062b57ab3f1810e916b13c6eb05b86133ad5d0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5427,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f8a762169de0346186ec62b168143b45adac2a6",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"target_port_label": "5427",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5427",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5427
|
—
|
proxy probe
proxy probe · port 5427 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5427
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5e9bc4b139a5314a10502736e136710356dd4f2c",
"event_fingerprint": "f3c0ec99b78d6694eef22ed024553eee34f33324",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ac162eba54695d7d13c3405dc0dc7492",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 5427,
"risk_score": 35
},
"payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c672f4b5c2ffd221d4f3db1187793c43a29819f7",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"port": 5427
},
"evidence_snippet": "P",
"attack_vector": "proxy probe \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"target_port_label": "5427",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"port": 5427
},
"attack_vector": "proxy probe \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"evidence_snippet": "P",
"target_port_label": "5427",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "c2635378686653a054433ef2dc8e96a261e6f26a",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0172917a454b6c00828bc2276f81229798b617f0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5427"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427
|
—
|
Sonde port
Sonde port · port 5427 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5427
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a4be75a32a56e771b2ef236766d8b14a2ff13a8f",
"event_fingerprint": "a1062b57ab3f1810e916b13c6eb05b86133ad5d0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5427,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbc7562819242438099877d9cd9bdec172a62adf",
"protocol_details": {
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"target_port_label": "5427",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5427",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8989 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8989 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8989
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.274633913818779,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8989,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8819fe8ffdd32005040bf7221360cc2f73d79deb",
"event_fingerprint": "18506b576e9aa0ee8b04f2e338bae22dd65248c7",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4459c55ff5a086d3ea8e5ed21a6d9199",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb48bc98328e7620f451c0f7bbc3053fdccdb33c",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
8989 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8989 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8989
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDphZG1pbg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.27937769946974,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8989,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8819fe8ffdd32005040bf7221360cc2f73d79deb",
"event_fingerprint": "18506b576e9aa0ee8b04f2e338bae22dd65248c7",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e713cfd249c1c29e7375ebcd5785159b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "45da458992c75bff3fdab0c3a5782bd7c708b13d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
8989 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8989 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8989
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic d29yazpUaWtpMjAyNUAh
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.217340164679102,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8989,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8819fe8ffdd32005040bf7221360cc2f73d79deb",
"event_fingerprint": "18506b576e9aa0ee8b04f2e338bae22dd65248c7",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "90404d1017989ca3b7f03af32c5b5eb6",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63b4c3c237aaa1af4c6da5b8774c8e5bc188357e",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
32935 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
32935
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDphZG1pbg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.27937769946974,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 32935,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "33a306bca50d121e8f488605af596e4abada3d35",
"event_fingerprint": "9916260f40af74f0221b10ffeb41a6325caba5ba",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e713cfd249c1c29e7375ebcd5785159b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 32935,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "247826d0374d292bb069cbf440152f8328f03bc7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32935,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32935"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
32935 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
32935
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 32935,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "33a306bca50d121e8f488605af596e4abada3d35",
"event_fingerprint": "9916260f40af74f0221b10ffeb41a6325caba5ba",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 32935,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e3ac04fd723684ac9ab551c34e1a918af5d5b3a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32935,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32935"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
32935 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
32935
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cTpx
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 92,
"payload_entropy": 4.960622282776353,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 32935,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "33a306bca50d121e8f488605af596e4abada3d35",
"event_fingerprint": "9916260f40af74f0221b10ffeb41a6325caba5ba",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2007df983cce3598fc0b84e7e5f13ab5",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 32935,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a552c98fb71159cff11406ddbd423cd6582d4086",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32935,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32935"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
1176 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:1176 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
1176
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic ODg4Ojg4OA==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.058124768156187,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 1176,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bbfd17b6a4609f47440bb18bb24c56aef8cc040f",
"event_fingerprint": "0f1ab17c15406f6f60a024a6eab7e51f69b27d06",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6577cedac838c593b5c3393dfcce34f1",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 1176,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9ff66ee1b19c4e0d6a3ac19a64ea78368b60a3f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1176,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1176"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
1176 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:1176 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
1176
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDo5MzA5MjA=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.177173944824638,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 1176,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bbfd17b6a4609f47440bb18bb24c56aef8cc040f",
"event_fingerprint": "0f1ab17c15406f6f60a024a6eab7e51f69b27d06",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f076608fd5099b049a18ad224e741fd",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 1176,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc679ec4d8166b222ccf43279c2c6d3a8b7268de",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1176,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1176"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
7905 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:7905 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
7905
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cHJveHk6dXNlcg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.24531860223975,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 7905,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cb96abdeeb8a58b1dff6199a4e71a1355da625b9",
"event_fingerprint": "4eb042b21addfa1e0616ea74185280d9011f51ce",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "226905f5e03031a1ad3c0f6e46450b52",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 7905,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "101834b666696f632e547d09634573ad208365d6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 7905,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7905 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "7905 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7905,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 7905,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7905 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"target_port_label": "7905 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7905"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "742f0506dda10d619c07ea636dc1e279fc48b0a7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic dXNlcjpzaGFkb3c=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.234866252516944,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d24acefdabe4cd496c9f82efe445d69",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e99992f5612fb8b988cbae83d5eaf7925f32131",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "742f0506dda10d619c07ea636dc1e279fc48b0a7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.313547197323206,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "65bbef1bc81f34b40aabe7d248345174",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "25029d9c090bf85cf548fc397a5a02084e08e9ce",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMjMhQCNRd2U=",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic YWRtaW46cGFzczEyMw==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.234546558659879,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4eab64a9ce06f7667ac588653710754b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d5eecf7be82c4ace96decd8c3e33d3f78b6a418",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cGFzczEyMw==",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 128,
"payload_entropy": 5.453098051950114,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2abe292732f30f147052ac88f6f446c6",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e90ce1a2b8bdc2e5b059e0cbad438c9d965f98b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDphcmNo
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.1272086605472476,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c72f84f733eed2812e96608ce7971ff0",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "554fc4ca14c8596520a8ab3cc630decec4e50bcc",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphcmNo",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.233621878381084,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9dcf36b384eab8a515f15561b6b68cd5",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aba34bf99cf56f0f9ab69843ba07a17a47d23cd5",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46UDRzc3cwcmQ=",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "742f0506dda10d619c07ea636dc1e279fc48b0a7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
21323 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
21323
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.305597583679141,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 21323,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e",
"event_fingerprint": "b20ef44f11e4499db5de8d3d98589c22577fb264",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "de1ea36356d29ad44d80687e3c17a01c",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 21323,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "934ffa808b4948e5fb6e29da419aaf08ed0652bc",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21323,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 21323,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpUaDEyMzQ1Njc4OQ==",
"target_port_label": "21323 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
6377 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:6377 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
6377
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 128,
"payload_entropy": 5.453098051950114,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 6377,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5821edafebe0140b5350c341fd984f3b6b27b5be",
"event_fingerprint": "1d0d0bd8379536b6708356c7c991dedef746fb38",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2abe292732f30f147052ac88f6f446c6",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 6377,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c994ede8167da80d3968df3e5aee71179143c450",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 6377,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6377 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "6377 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6377,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 6377,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6377 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"target_port_label": "6377 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6377"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
6377 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:6377 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
6377
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.193278977317785,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 6377,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5821edafebe0140b5350c341fd984f3b6b27b5be",
"event_fingerprint": "1d0d0bd8379536b6708356c7c991dedef746fb38",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b788cd5a77ac1dc1d18eff2069a27a0",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 6377,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a59808ec5ed231e643dcb787473b17736019837e",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 6377,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6377 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "6377 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6377,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 6377,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6377 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "6377 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6377"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
6377 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:6377 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
6377
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.18168076287704,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 6377,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5821edafebe0140b5350c341fd984f3b6b27b5be",
"event_fingerprint": "1d0d0bd8379536b6708356c7c991dedef746fb38",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e5510bf9427dd0d231e931181f76bc04",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 6377,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4133b9b1617983afa3d605b933ced6255b75fdcc",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 6377,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6377 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "6377 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6377,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 6377,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6377 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3cwcmQ=",
"target_port_label": "6377 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6377"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
8181 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8181 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8181
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic MTIzNDU6MTIzNDU=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.1412572381562756,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8181,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e27a6f5393dee2f47ba32b2318c22cad0e9a0077",
"event_fingerprint": "d4e1023177df66b3512c86b3346cfe6fb9aef4e6",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ad040c52a95e3793748a1ba4baac4bde",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8181,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7d2163ce84aa48b90e3d04d3bf71b4f84db5d492",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8181,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8181 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8181,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8181,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8181 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"target_port_label": "8181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad896cd25de1d338e6436977ece97858776294c2",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
]
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDptdXNpYyE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.233657627333552,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9d949ad3d8d6af970a3df83b15db5e9f",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08a1654cb6b9d89ece97eb10496c75f798434955",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDptdXNpYyE=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
]
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpnYWRpbmc=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.284091401351212,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6f4ddcde23a0471f148a6ffddedcc79",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e721bcb7c0c50ed792eb33cde0d7bdcd1ee9919",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpnYWRpbmc=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
2811 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
2811
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 2811,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc",
"event_fingerprint": "d0485e552d249e045029bf3e4a988af5c0de303e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 2811,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c84b87f184470ad75fa18a4fcf4556b3b697de3a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 2811,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "2811 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2811,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 2811,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "2811 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2811"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2811"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
2811
|
—
|
Sonde port
Sonde port · port 2811 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2811
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 2811,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36",
"event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2811,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2",
"protocol_details": {
"port": 2811
},
"attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)",
"target_port_label": "2811",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2811,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 2811
},
"attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2811",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2811"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
2811 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
2811
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDoxMTA1ODM=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.175005074736342,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 2811,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc",
"event_fingerprint": "d0485e552d249e045029bf3e4a988af5c0de303e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bd572d1c31b4d3584ae3c9e21c966593",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 2811,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c417844a8a3dd7e7ed7d0b3166b230f6e90932d8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 2811,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "2811 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2811,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 2811,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDoxMTA1ODM=",
"target_port_label": "2811 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2811"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2811"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
2811
|
—
|
Sonde port
Sonde port · port 2811 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2811
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 2811,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36",
"event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2811,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2",
"protocol_details": {
"port": 2811
},
"attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)",
"target_port_label": "2811",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2811,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 2811
},
"attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2811",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2811"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
2811
|
—
|
Sonde port
Sonde port · port 2811 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2811
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 2811,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36",
"event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2811,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2",
"protocol_details": {
"port": 2811
},
"attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)",
"target_port_label": "2811",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2811,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 2811
},
"attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2811",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2811"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad896cd25de1d338e6436977ece97858776294c2",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.3609491924969435,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c4d7c18ac843f91d17ee3ba8afdfbd85",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ff60f7c0728cfea58f4c5df9a26aa721945e4ed",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpxYXdzZWRyZg==",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad896cd25de1d338e6436977ece97858776294c2",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic dXNlcjo2NTQzMjE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.1869773102924635,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "0656904dab8c0cc8f338cbfd8f40826e843ccdb0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "afd454038a1dae5a2845f5e1ce5bd490",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e3cefe98c5dd8e9ba43da8b9b2b01772e9d45d4",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197170,
"country": "NL",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
]
}
|