|
|
TCP |
18419 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
18419
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.193278977317785,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 18419,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323",
"event_fingerprint": "181b2f7cf1cc349ba18d16781f9a63f9d9459ef9",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b788cd5a77ac1dc1d18eff2069a27a0",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 18419,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b702553a43d39ff0e4b2611cc4d31782fd1823e7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 18419,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "18419 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18419,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 18419,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "18419 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18419"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
9169 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9169 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9169
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.185951690356521,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9169,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "96a23576b1606ebdbd15d82f203c4cec35408ad9",
"event_fingerprint": "a73d56677f337e2689cc6afa465071c2258873a5",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "604396e37827b5c6f3b37d8836c8e7a1",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 9169,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed8d92feca971fc44f36b245492b76043b678902",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 9169,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9169 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "9169 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9169,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 9169,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9169 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "9169 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9169"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
20648 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
20648
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 20648,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e",
"event_fingerprint": "cb7ee8010bf6e8b0337fcdd6bc02b81384ea4244",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 20648,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77345b93401a0ed45458496b234649e707309b5f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20648,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20648"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
20648 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
20648
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.279195101236418,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 20648,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e",
"event_fingerprint": "cb7ee8010bf6e8b0337fcdd6bc02b81384ea4244",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ad65ea09d79074efb8828d7161a3196",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 20648,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c00f608ce060a34a82649fc111f6ee5ae85233f6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20648,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDpkZXN0aW55MTIz",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20648"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
20648 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
20648
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cTFxMXExOnExcTFxMQ==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.138966151283639,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 20648,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e",
"event_fingerprint": "cb7ee8010bf6e8b0337fcdd6bc02b81384ea4244",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70b2a938a0e44ad85f7ecbce3c1696e4",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 20648,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "176fa6e12060dcc7fa953fe0f992e8cfa5e81883",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20648,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 20648,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTFxMXExOnExcTFxMQ==",
"target_port_label": "20648 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20648"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "d2d5673af5f6164be53064c5fe3b0e42c3b9a7de",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84b872b7f750fdf20576f7989312e465ec912f75",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic M3Byb3h5Og==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.067208660547247,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "d2d5673af5f6164be53064c5fe3b0e42c3b9a7de",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "849dbe7f24b7671177ac316117145dd1",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c1bd6d0dbe29534ddddd44f9eca07eea4c224f5",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic M3Byb3h5Og==",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic c2FjaGluOnNhY2hpbg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.290941445555632,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "d2d5673af5f6164be53064c5fe3b0e42c3b9a7de",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "202f8795487aec32c9e1669099318bc0",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aab298f7e475f53145b62875d454dbed85166218",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic c2FjaGluOnNhY2hpbg==",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427
|
—
|
Sonde port
Sonde port · port 5427 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5427
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a4be75a32a56e771b2ef236766d8b14a2ff13a8f",
"event_fingerprint": "a1062b57ab3f1810e916b13c6eb05b86133ad5d0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5427,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f8a762169de0346186ec62b168143b45adac2a6",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"target_port_label": "5427",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5427",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5427
|
—
|
proxy probe
proxy probe · port 5427 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5427
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5e9bc4b139a5314a10502736e136710356dd4f2c",
"event_fingerprint": "f3c0ec99b78d6694eef22ed024553eee34f33324",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ac162eba54695d7d13c3405dc0dc7492",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 5427,
"risk_score": 35
},
"payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c672f4b5c2ffd221d4f3db1187793c43a29819f7",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"port": 5427
},
"evidence_snippet": "P",
"attack_vector": "proxy probe \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"target_port_label": "5427",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
"port": 5427
},
"attack_vector": "proxy probe \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"evidence_snippet": "P",
"target_port_label": "5427",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
|
|
|
TCP |
5427 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5427 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5427
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "418f335c85c39d1b740d8789e7e4a7b41b714ff5",
"event_fingerprint": "c2635378686653a054433ef2dc8e96a261e6f26a",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 5427,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0172917a454b6c00828bc2276f81229798b617f0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 5427,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5427 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "5427 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5427"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
5427
|
—
|
Sonde port
Sonde port · port 5427 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5427
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5427,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a4be75a32a56e771b2ef236766d8b14a2ff13a8f",
"event_fingerprint": "a1062b57ab3f1810e916b13c6eb05b86133ad5d0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5427,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbc7562819242438099877d9cd9bdec172a62adf",
"protocol_details": {
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"target_port_label": "5427",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5427,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5427
},
"attack_vector": "Sonde port \u00b7 port 5427 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5427",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5427"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8989 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8989 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8989
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.274633913818779,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8989,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8819fe8ffdd32005040bf7221360cc2f73d79deb",
"event_fingerprint": "18506b576e9aa0ee8b04f2e338bae22dd65248c7",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4459c55ff5a086d3ea8e5ed21a6d9199",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb48bc98328e7620f451c0f7bbc3053fdccdb33c",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
8989 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8989 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8989
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDphZG1pbg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.27937769946974,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8989,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8819fe8ffdd32005040bf7221360cc2f73d79deb",
"event_fingerprint": "18506b576e9aa0ee8b04f2e338bae22dd65248c7",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e713cfd249c1c29e7375ebcd5785159b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "45da458992c75bff3fdab0c3a5782bd7c708b13d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
8989 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8989 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8989
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic d29yazpUaWtpMjAyNUAh
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.217340164679102,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8989,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8819fe8ffdd32005040bf7221360cc2f73d79deb",
"event_fingerprint": "18506b576e9aa0ee8b04f2e338bae22dd65248c7",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "90404d1017989ca3b7f03af32c5b5eb6",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63b4c3c237aaa1af4c6da5b8774c8e5bc188357e",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8989 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic d29yazpUaWtpMjAyNUAh",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
32935 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
32935
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDphZG1pbg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.27937769946974,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 32935,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "33a306bca50d121e8f488605af596e4abada3d35",
"event_fingerprint": "9916260f40af74f0221b10ffeb41a6325caba5ba",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e713cfd249c1c29e7375ebcd5785159b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 32935,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "247826d0374d292bb069cbf440152f8328f03bc7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32935,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDphZG1pbg==",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32935"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
32935 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
32935
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.160704752887782,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 32935,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "33a306bca50d121e8f488605af596e4abada3d35",
"event_fingerprint": "9916260f40af74f0221b10ffeb41a6325caba5ba",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e16a8562718e9d4ba95f2d2f1ed2b44b",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 32935,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e3ac04fd723684ac9ab551c34e1a918af5d5b3a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32935,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32935"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
32935 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
32935
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cTpx
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 92,
"payload_entropy": 4.960622282776353,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 32935,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "33a306bca50d121e8f488605af596e4abada3d35",
"event_fingerprint": "9916260f40af74f0221b10ffeb41a6325caba5ba",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2007df983cce3598fc0b84e7e5f13ab5",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 32935,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a552c98fb71159cff11406ddbd423cd6582d4086",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32935,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 32935,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cTpx",
"target_port_label": "32935 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32935"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
1176 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:1176 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
1176
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic ODg4Ojg4OA==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.058124768156187,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 1176,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bbfd17b6a4609f47440bb18bb24c56aef8cc040f",
"event_fingerprint": "0f1ab17c15406f6f60a024a6eab7e51f69b27d06",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6577cedac838c593b5c3393dfcce34f1",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 1176,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9ff66ee1b19c4e0d6a3ac19a64ea78368b60a3f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1176,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1176"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
1176 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:1176 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
1176
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cm9vdDo5MzA5MjA=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.177173944824638,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 1176,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bbfd17b6a4609f47440bb18bb24c56aef8cc040f",
"event_fingerprint": "0f1ab17c15406f6f60a024a6eab7e51f69b27d06",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f076608fd5099b049a18ad224e741fd",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 1176,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=\r\n\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=\r\n\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc679ec4d8166b222ccf43279c2c6d3a8b7268de",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1176,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 1176,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1176 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cm9vdDo5MzA5MjA=",
"target_port_label": "1176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1176"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
7905 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:7905 · (sonde / probe) · → 45.153.34.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 45.153.34.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
45.153.34.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
7905
Chemin / cible
45.153.34.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 45.153.34.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 45.153.34.47:80 HTTP/1.0
Host: 45.153.34.47:80
Proxy-Authorization: Basic cHJveHk6dXNlcg==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_target_hash": "d3b091cd568d756aaef76672a25e6bb27c8276ea",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.24531860223975,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 7905,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cb96abdeeb8a58b1dff6199a4e71a1355da625b9",
"event_fingerprint": "4eb042b21addfa1e0616ea74185280d9011f51ce",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "226905f5e03031a1ad3c0f6e46450b52",
"path_pattern_hash": "ac9c1d21487d30c1291aa4b789aaa9aa"
},
"service_name": "http",
"target_context": {
"dst_port": 7905,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==\r\n",
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"evidence": {
"method": "CONNECT",
"path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"request_sample": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==\r\n",
"payload_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "101834b666696f632e547d09634573ad208365d6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 7905,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7905 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"target_port_label": "7905 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7905,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "45.153.34.47:80",
"request_line": "CONNECT 45.153.34.47:80 HTTP\/1.1",
"port": 7905,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7905 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.153.34.47:80",
"evidence_snippet": "CONNECT 45.153.34.47:80 HTTP\/1.0\r\nHost: 45.153.34.47:80\r\nProxy-Authorization: Basic cHJveHk6dXNlcg==",
"target_port_label": "7905 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7905"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|