Renseignement sur les menaces

Pays-Bas

45.153.34.89

FAI TechTies Inc. Première vue 11/07/2026 07:18 UTC Dernière vue 20/07/2026 06:55 UTC Risque Moyen

Période analysée : 2026-06-21 → 2026-07-21

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (50 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 53/100 Moyen

Première observation 11/07/2026 07:18 UTC

Dernière observation 20/07/2026 06:55 UTC

Événements (période) 429

MITRE ATT&CK principal T1046 425 occurrences

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (50 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +23

Comparaison ASN / FAI

ASN 197170 · 45.153.34.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 429 événements sur la période pour cette IP.

91.92.40.10 Sonde port 20/07/2026 22:00 UTC
91.92.42.80 Sonde port 8082/TCP 20/07/2026 21:50 UTC
45.153.34.54 Cross-site scripting 20/07/2026 19:31 UTC
91.92.47.90 Sonde SSH 20/07/2026 19:04 UTC
45.156.87.192 Sonde port 20/07/2026 18:49 UTC
91.92.40.12 Sonde HTTP 20/07/2026 18:41 UTC
91.92.40.231 Sonde port 22/TCP 20/07/2026 15:28 UTC
45.156.87.34 Sonde SSH 20/07/2026 14:49 UTC

Événements (filtres)

429

Première observation

11/07/2026 07:18 UTC

Dernière observation

20/07/2026 06:55 UTC

Dernière activité (filtres)

20/07/2026 06:55 UTC

Événements 7j

425

Ports distincts (7j)

133

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 286 SOCKS5 TCP 8 HTTPS TCP 6 SAP ICM TCP 4 CONSUL TCP 4 COUCHBASE TCP 4 HDFS NAMENODE TCP 4 TOR OR TCP 4 KERBEROS TCP 2 BITCOIN TCP 2 TOR SOCKS TCP 2 SMTP ALT2 TCP 2 JAVA RMI TCP 2 JETDIRECT TCP 2 DISCORD WEBHOOK TCP 2 SQUID ALT TCP 2 KAFKA JMX TCP 2

HTTP

286

SOCKS5

HTTPS

SAP ICM

CONSUL

COUCHBASE

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

TechTies Inc. 0 Port 6588 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:8009 · (reconnaissance) · → check.proxypool.sh:443

Détails protocole

Méthode: CONNECT
Chemin: check.proxypool.sh:443
User-Agent: Go-http-client/1.1

Aperçu payload

CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1

Port / service

8009 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 4 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

429 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

429 événement(s) — page 1/9

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/07/2026 06:55:47 UTC	TCP	8009 · HTTP	http	Scan de ports port scan syn · via HTTP:8009 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8009 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8009, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f837f30ae51006e1d97238a5066c8b1039342fc5", "event_fingerprint": "3f15536eb8a060fe6a3d881758a098828b69ecae", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8009, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ae7520b79dd4be4d6a1c16f849d37521e304f31c", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8009, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8009 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8009, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8009, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8009 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 38.64, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8017 · HTTP	http	Scan de ports port scan syn · via HTTP:8017 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8017 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jr HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jr HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jr HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "c50fece37c3a73d934ac65cd0c74bb42df8949e9", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.028654452174825, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8017, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "53c369ea5bb016abb1d30bcefaaf772c03fad3b5", "event_fingerprint": "ecaf77a0a0fc318072247150d1c87b10ed704a6f", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b62faba50af6ebb3c4f2d57dba9ecff1", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8017, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet5jr", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet5jr", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "04fd541785424371f8fe78559a8f7f5a1c2ce4b4", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1", "port": 8017, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8017 \u00b7 (reconnaissance)", "target_port_label": "8017 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8017, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1", "port": 8017, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8017 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8017 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8017" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 41.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8012 · HTTP	http	Scan de ports port scan syn · via HTTP:8012 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8012 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k5 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k5 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k5 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "72b2b1ad63012b7aff84822bf2268ea48c10e24d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.034557787369291, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8012, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ea47f95da91e8b847075910a80b0e4d5f851f0a1", "event_fingerprint": "ae39252fff8ee0c1699ea886d64b56835292c2ef", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "db384fc4265b87316e1ada796db460d0", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8012, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet5k5", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet5k5", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24dcf3a04b662c2bb531dcd54858f045fbc10176", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1", "port": 8012, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance)", "target_port_label": "8012 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8012, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1", "port": 8012, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8012 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8012" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 41.28, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8001 · HTTP	http	Scan de ports port scan syn · via HTTP:8001 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8001 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1986227291262429d3ea4c1b44f8eec10fccb608", "event_fingerprint": "5beb0810c5360cb9c6ad84256296e518ad27ea2d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8001, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0df8537cf412b76940aa0fcc166a5537b20cb564", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8001 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8001 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.72, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	9002 · HTTP	http	Scan de ports port scan syn · via HTTP:9002 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9002 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 9002, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "55c944bd11ab882ac9535ecc1e3187f3a341045c", "event_fingerprint": "9d504e9b903c427a4eeb6e57ddc5aa65974c20eb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 9002, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf11a1d9e58c4cd9583202c76caf34f29c1f5d2b", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9002, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.65, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Scan de ports port scan syn · via HDFS NAMENODE:8020 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197170, "country": "NL", "dst_port": 8020, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b2c3901b70b17ba99999de6bc6ac03b92a0292d6", "event_fingerprint": "004499a144c92e4455aac1722fd9719117630099", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8be1d4e66bdabff3ef4e9cf996febd444f7e01a0", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HDFS NAMENODE:8020 \u00b7 (reconnaissance)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "port scan syn \u00b7 via HDFS NAMENODE:8020 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.6, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8010 · HTTP	http	Scan de ports port scan syn · via HTTP:8010 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8010 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet609 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet609 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet609 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "97c0765fb5ae28f00404cb6d9eed913f95f597a2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.444692535795092, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8010, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "d5eb630536768423518d12a2fb2708f96c4ff263", "event_fingerprint": "7d955e472d02ecde5904bbc36a189ebd0d89322c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "7b6921ea08a694ed04443d9d6db71afb", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8010, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet609", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet609", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a1694dfbeee08cbb471871a3cb816e39e8b2104b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8010, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance)", "target_port_label": "8010 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8010, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8010, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet609 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8010 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8010" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.49, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8004 · HTTP	http	Scan de ports port scan syn · via HTTP:8004 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8004 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8004, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7ffcda27eb37100aa1eb0926a740f6fc3cfef9a4", "event_fingerprint": "7e19369c31bb1b847315a1717a06fa8882a7d827", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "09b80e706c311551225d57466f7237db61dbf90c", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8009 · HTTP	http	Scan de ports port scan syn · via HTTP:8009 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8009 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6gb HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6gb HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6gb HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "9f8fca6e133c3a17cef7b7fb3ebcf4474f5eb188", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.446980074715092, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8009, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "729d6ab8bca4f56de2b51af4b66105a75da842ab", "event_fingerprint": "013b89602d99b8436c762a901be9065c7af2bad2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "441ae85ee1873eb2c3cd6a721b2742a3", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8009, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6gb", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6gb", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed12c5abd69f7c215894c286bcba7b52eeb9d35b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8009, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)", "target_port_label": "8009 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8009, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8009, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6gb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8009 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.3, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	9999 · HTTP	http	Scan de ports port scan syn · via HTTP:9999 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9999 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 9999, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2a61a29c33dce106e6777d1bc5052c53186e363d", "event_fingerprint": "a6c89a0a47a94f8dc0f2bd7f61bb34b07c8048da", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 9999, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28e49b4f86bec3674c55656280f4d4fe28266551", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 9999, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "9999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9999, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 9999, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "9999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.23, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	9002 · HTTP	http	Scan de ports port scan syn · via HTTP:9002 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9002 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6g9 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6g9 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6g9 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "de43bda674732fa4d104365f55d8ea58c8ed1697", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.446980074715092, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 9002, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "18bca37bb4eecc87620aa47433f0724c22ff8a56", "event_fingerprint": "3406f8b0f6a7d1fb628892e4c1fa4116718ffe94", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "60103e4a39db7c41ed1d0747e4fe69dd", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 9002, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6g9", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6g9", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "241dacd02030ce08a9946377c89cfb2913717d27", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9002, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6g9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40.08, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 3128, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "9feaa072d5204aa9530fc114b7bc1f46ccf47d1b", "event_fingerprint": "635c1faec85527b25fcdc7d0e0f35266de9478b6", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7aa441ec1821fd7566c792a5bed73c91c2fd22a9", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 40, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8017 · HTTP	http	Scan de ports port scan syn · via HTTP:8017 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8017 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6h9 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6h9 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6h9 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "b6ae632675f6de13496a26559a11055b5a213c27", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.021520029570421, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8017, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "53c369ea5bb016abb1d30bcefaaf772c03fad3b5", "event_fingerprint": "366914146b815ccda3debe2c9163758626c2dc54", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "38c7ae10c213648b6ec29bcf7878c9ac", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8017, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6h9", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6h9", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1e5d5e12671e4109ab1b3b30a87665747d25b5cd", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1", "port": 8017, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8017 \u00b7 (reconnaissance)", "target_port_label": "8017 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8017, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1", "port": 8017, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8017 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6h9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8017 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8017" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 39.84, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:46 UTC	TCP	8012 · HTTP	http	Scan de ports port scan syn · via HTTP:8012 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8012 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6hb HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6hb HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet6hb HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "df8e959fc7e01217c4a8bc850d13c14a25d3189b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.021520029570421, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8012, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ea47f95da91e8b847075910a80b0e4d5f851f0a1", "event_fingerprint": "e1c179ae96bbbd1d90128a0bfe92384ce2d81368", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d0c536a7c1f8d9b4f9b2f11145be4e78", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8012, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6hb", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet6hb", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4bccc5339f8a3ba201abdf508a06cd6fde13d84", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1", "port": 8012, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance)", "target_port_label": "8012 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8012, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1", "port": 8012, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet6hb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8012 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8012" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 39.33, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "62be6d7e3d79a4eeb105fc82599d7e6ca22777c0", "event_fingerprint": "f1c99d916ea96cad7d0e825ef732e2aa59b9f9d7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "378fb9da6a2b3a59e5665f07b225280981909651", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 66.83, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_flood sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "sap-icm", "app_proto": "sap-icm", "asn": 197170, "country": "NL", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "00a7cebdd774d8157135f2f0d8fcd09ecbdfe6dd", "event_fingerprint": "14084660eb60ff85b2906ba239774b3b39a005d0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "607ed5ba893c138f18c9004fe1ceaa6ef3425caa", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 66.69, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 06:55:45 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass HTTP alt 8888 probe Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4of HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4of HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4of HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "f9437c9b5fbebec2fe0f0e875d02a159eaeddef6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.440421874504929, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8888, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 51, "tag_count": 5, "anomaly_count": 0, "campaign_key": "862e4146b6ee97c4707afb8069948e3e669f8615", "event_fingerprint": "27cb9a902d1023e38def4007379af8defd43969f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0599" ], "matched_pattern_names": [ "LFI Double-dot bypass", "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0103", "pat-0599" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "4bf091c0d7ac38715a2e263048000586", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4of", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4of", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b587d75fb02c41ca45083d7ee19cd3bbfc2dc9e5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4of HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 66.37, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8200 · HTTP	http	Scan de ports port scan syn · via HTTP:8200 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8200 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8200, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1432bdcbf67ce8817ac884a354af0f84301e3482", "event_fingerprint": "7c6e17bb31b43e452a6d8b9827dc518684146690", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8200, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67a6a8f23adbb4da77cb168ef1a3c483e3e07612", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8200, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8200 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8200 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8200, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8200, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8200 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8200 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8200" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 66.2, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8005 · HTTP	http	Scan de ports port scan syn · via HTTP:8005 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8005 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oc HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oc HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oc HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "ac8d86a8f5f08ccf836626c5f9ac248f155352d8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.432735104707769, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8005, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "4c1ec5853fb77c2661bb63d06b7c48c92024f1ee", "event_fingerprint": "80e87110b0048701b9e017a32739a8d471eb8b8d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "25ba77de20f2ef23aed911e6ccbb38c7", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oc", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oc", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "58524ad4f0757389ed670f32265db92c2fb911af", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8005 \u00b7 (reconnaissance)", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8005 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 65.89, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8006 · HTTP	http	Scan de ports port scan syn · via HTTP:8006 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8006 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oh HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oh HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oh HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "081773f20571155e16b14aea17c3d04de7c163da", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.435948675006302, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8006, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "7051b3b1fbe74086d4e3c6c57566c5715da32cd2", "event_fingerprint": "fdc4b09a175d1a8dfabc6361df713aa50e9c34b8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "1f59aa789b43e9655ebf6e6bcf718776", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8006, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oh", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oh", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b0ed7ad54c9921c0d57d80101e5b4d4bfcc00a6e", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8006, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8006 \u00b7 (reconnaissance)", "target_port_label": "8006 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8006, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8006, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8006 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8006 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8006" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 65.58, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8123 · HTTP	http	Scan de ports port scan syn · via HTTP:8123 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oa HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oa HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oa HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "3439ce52fdb6907bb86e879a895bd118b043a8fc", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.4350946617934515, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8123, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00b28d3f561870a9f0b88d5ab0f2c916d55a53d3", "event_fingerprint": "72520952a30843d01965911e1b4acf0031f2e9aa", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "3ecefa8abc9f7aebdd86efdb0307d973", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oa", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oa", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f504e78d75072859e2933e99e960c2c33b7fb914", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oa HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 65.27, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8085 · HTTP	http	Scan de ports port scan syn · via HTTP:8085 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "54d1e08ff8693f2dfbe0fa61e31663df1ec51883", "event_fingerprint": "2b60e998ed0d228936c3d4387aade33765ec9ef8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a842740852bb24e682c8c5bae0e3f8b814e43c7", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8085 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8085 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 65.09, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8002 · HTTP	http	Scan de ports port scan syn · via HTTP:8002 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8002 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8002, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "66b08e8db78fca90b5dfd7ba3daa354f0bead6e7", "event_fingerprint": "8ca76323b7d45fecb8558385e746ff6bc616bf53", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8002, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b37913abd8b95fbfedeb47cac92abf60cd1d4775", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8002, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8002 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8002, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8002, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8002 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 64.93, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8085 · HTTP	http	Scan de ports port scan syn · via HTTP:8085 · (reconnaissance)	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ok HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ok HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ok HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "d457f53e3fbfe20d770dcba257b696191c2f791b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.439293304917931, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "99f087d463c6c9d6a6b5b6ca7f2c6a00333d3d83", "event_fingerprint": "1ee8e34e08238273885f21af1f3889e246f8f906", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "c5d9f51e402dbbf8e6ac0ca33fb9a4ec", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ok", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ok", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "255db8cc798176495a678f333316a125f3772e21", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8085 \u00b7 (reconnaissance)", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8085 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ok HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 64.63, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a9676ad98cd65e56357b8272e1267f57ab95008e", "event_fingerprint": "dd5bd6f728e7936664b9a79e36648e3693ea5de4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7828d85691dcc1d800f12bfecb10dc790d7c0f4a", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 64.45, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8006 · HTTP	http	Scan de ports port scan syn · via HTTP:8006 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8006 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8006, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7c3330d552d8e2449e4cdff76470a3fefac00351", "event_fingerprint": "f10b0df69ddd0017fb9fa3cb23120494f9527d3c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8006, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1de45b54187fd4c69c37993e8ea9ae3367a254e4", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8006, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8006 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8006 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8006, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8006, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8006 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8006 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8006" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 64.24, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8000 · SAP ICM	sap-icm	Scan de ports port scan syn · via SAP ICM:8000 · (reconnaissance)	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags mozi_pattern net_flood sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oy HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oy HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oy HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 323, "payload_entropy": 5.441939598949737, "port_category": "registered", "org": "TechTies Inc.", "service": "sap-icm", "app_proto": "sap-icm", "asn": 197170, "country": "NL", "dst_port": 8000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 46, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d30d29938ad6b779f70084d74dd9d6ec5bcade42", "event_fingerprint": "14084660eb60ff85b2906ba239774b3b39a005d0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 46, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e1f13326f1322683e31e2d4fef093dd9", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 46 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0dc3b0f2efb79ceee27966ad542c7f25f086c811", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 46, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 46, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 64.06, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mozi_pattern", "net_flood", "sap_icm_emulated", "sap_icm_payload" ] }
20/07/2026 06:55:45 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4om HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4om HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4om HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "80a81f364819491677455119cb9c2a68a5bacf31", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.441939598949736, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8880, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "a8d40ceeb562baf1c6fc5f79ec9e3c20027a2a2d", "event_fingerprint": "febca0bc024a96a0790ad77543bb4bdace982c50", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "4a892a290f5e939b4aa42eb531516e04", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4om", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4om", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9a85026413b3b2b49a183cfd2a41b8fc69407ba7", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance)", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4om HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 63.78, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8123 · HTTP	http	Scan de ports port scan syn · via HTTP:8123 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8123 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8123, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "17f82b1d756dacff9d807e5a8c1b679067984873", "event_fingerprint": "b768b58240d9c0c4490142a51979aa3cfc8e02c2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a5250ff2f4857fd91d6fb500388d8ade308fbaf", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 63.61, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8030 · HTTP	http	Scan de ports port scan syn · via HTTP:8030 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8030 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8030, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c51ebdadf905dcff5c5ceced2c79d486bb319cc5", "event_fingerprint": "b95b55ac2fb5b79bfac3ffe91ac254db8d00908a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8030, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3103dcb9acf102cf53724d6b9a930247bdf72db0", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8030, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8030 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8030 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8030, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8030, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8030 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8030 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8030" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 63.46, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8070 · HTTP	http	Scan de ports port scan syn · via HTTP:8070 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8070 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ot HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ot HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ot HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "f3dfd0146444a1e21d2ae1cca1911527d25b7920", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.435501272776445, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8070, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "d2e7392f90a3dff405e22db21eb3f3e539e0981a", "event_fingerprint": "478efe8e5ad7c3d493335787a51def4daa6c179c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "22182c30a6affea8f3aaeab4118f0dd9", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8070, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ot", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ot", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "21e99048fe9ed8ecae9f20c89f850590fe51a1a3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8070, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8070 \u00b7 (reconnaissance)", "target_port_label": "8070 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8070, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8070, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8070 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ot HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8070 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8070" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 63.18, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8040 · HTTP	http	Scan de ports port scan syn · via HTTP:8040 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8040 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8040, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "43b0912d8110e60d9e88dafb9ec7aade80791ea4", "event_fingerprint": "9999e76d9c815391eaa551a7e9f184a61f21e436", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8040, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0fef928ad9440dfd41f0242256f27e8e8d654f8e", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8040, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8040, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8040, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8040" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 62.94, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8082 · HTTP	http	Scan de ports port scan syn · via HTTP:8082 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a4b36636b4c6bfe7297071593d3e1d59a19d7ef4", "event_fingerprint": "b2aa97ce9ec8f9b3d12ff2c6f76b0eaaccd1694d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "57731c34b16a994f5b2c68fffb5ec9bddc04f267", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 62.78, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8001 · HTTP	http	Scan de ports port scan syn · via HTTP:8001 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8001 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4p3 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4p3 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4p3 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "cf62fcce3a0b9464d62db0a0e9836ace0b5c705c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.43971762399392, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8001, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "2b0d129c38bfde3bdb39b632d38cf1df82908233", "event_fingerprint": "d9138b777ad4399dab94c5c73167bb048aa0ddec", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "54d32888522cea1b01d1a1847491e354", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8001, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4p3", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4p3", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "42a2214b1d883b15ad8eb1c74ba857533eff12b8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8001 \u00b7 (reconnaissance)", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8001 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 62.5, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8060 · HTTP	http	Scan de ports port scan syn · via HTTP:8060 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8060 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4op HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4op HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4op HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "94c4d2766124de9d7e8f5b25a701bb8bee5c89b7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.434058786184543, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8060, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "abc5a2bfb7bea9717bfd71b8e15dbc41d34a5f43", "event_fingerprint": "937e7b2b63f9c6246aacb6053635efcd2f884560", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "423d7d7a8c42d03e67245f35f998c4e3", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8060, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4op", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4op", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "010257000d7777c5a8458a945e7de0a4c72b4c92", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8060, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8060 \u00b7 (reconnaissance)", "target_port_label": "8060 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8060, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8060, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8060 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4op HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8060 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8060" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 62.22, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8003 · HTTP	http	Scan de ports port scan syn · via HTTP:8003 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8003 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8003, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "dfb9b983c8c9f11e015cb0b14df4cddf845bc0d5", "event_fingerprint": "96b52b6cd6be4c75207f30aaeed3c8717708d45c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8003, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "abc7500e0014850937500b24177573cfa14ebf89", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8003, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8003 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8003 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8003, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8003, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8003 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8003 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8003" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 62.06, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8040 · HTTP	http	Scan de ports port scan syn · via HTTP:8040 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8040 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oo HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oo HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oo HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "1e3a87ddb655609d8f8e1735c9068accb98a3aa4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.432511684155795, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8040, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "948ea3ca5185fed11e32ff6efab6e99e37d9808d", "event_fingerprint": "2b5a7b0ad6e7588fe8518f211e45c672b7ad00f7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "bb937701d654522f60f94284edf9e9ac", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8040, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oo", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oo", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fc7c60257c78bce5ad5cf0ccc84d987db9c34fef", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8040, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)", "target_port_label": "8040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8040, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8040, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oo HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8040" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 61.78, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8082 · HTTP	http	Scan de ports port scan syn · via HTTP:8082 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8082 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ow HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ow HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ow HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "428d192df1a0198900a5819772a6d15f8fcc1dee", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.44427671195953, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8082, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 51, "tag_count": 5, "anomaly_count": 0, "campaign_key": "24bd5bc426c0523c38554059bd5317a130c6a7c9", "event_fingerprint": "b048bc5c57076419ca395219c8799444c71d9929", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "b2577cccd2a9cb0a085d640150a620b3", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ow", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ow", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "529d8fbd329ecdbef64807ab4c3540b9b662641e", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance)", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ow HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 61.51, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8030 · HTTP	http	Scan de ports port scan syn · via HTTP:8030 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8030 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4p7 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4p7 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4p7 HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "3c465b6141fa1bfd1a9a18cd5b0f9077375a0d03", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.4432632804265095, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8030, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e2de6867bca121a396df101e5389f94f39bfbfcf", "event_fingerprint": "34aa7e92bb55626c00ba7302ea395c51edad5ef4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "80499ca1ba77530ee045fa79c232be8d", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8030, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4p7", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4p7", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dda715cd3d978011d6db5049afd42b5b28bc7e84", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8030, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8030 \u00b7 (reconnaissance)", "target_port_label": "8030 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8030, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8030, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8030 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4p7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8030 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8030" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 61.24, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	81 · HTTP	http	Scan de ports port scan syn · via HTTP:81 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ov HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ov HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ov HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "e32ecd6ad11a4ab798510f1b8b548f1b4b6ad7cf", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.450468662423926, "port_category": "well_known", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 81, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 51, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e09e5d4314652fb2b3be91458f03699a26efb139", "event_fingerprint": "69d18d6e480bd283749012074324c38b6a44edf1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "c22ef8b2fe3c4408832b3f54d19ae8d1", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ov", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ov", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b623e6585d4875faf876a27f1cddbd4d109bf4d2", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ov HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 60.97, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8081 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oz HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oz HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4oz HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "cae9354ee01778b16539eb5be51212fd15cb944e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.441939598949736, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8081, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 51, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8a743470acf9fda54b0d4b0499250ebbb0f965bb", "event_fingerprint": "07da4243de01ec9a7f3a84f34a7eda906355f7e1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "707a8dbd01e5ebafefd1e23a3b50b589", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4oz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9dda3ab292dc0ebb64ce9721279fea0c37690c97", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance)", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4oz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 60.71, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Scan de ports port scan syn · via HDFS NAMENODE:8020 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload mozi_pattern net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pj HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pj HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pj HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 323, "payload_entropy": 5.445600393436304, "port_category": "registered", "org": "TechTies Inc.", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197170, "country": "NL", "dst_port": 8020, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 49, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1a0f07ae561431c986c9583c43217b1eb4bfceae", "event_fingerprint": "004499a144c92e4455aac1722fd9719117630099", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7be943c1eb3207d26ee1286f10216be6", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "116b51b1b42e5e9937996526c6799da84c1bde2e", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HDFS NAMENODE:8020 \u00b7 (reconnaissance)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "port scan syn \u00b7 via HDFS NAMENODE:8020 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 60.49, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "mozi_pattern", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8002 · HTTP	http	Scan de ports port scan syn · via HTTP:8002 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8002 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pi HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pi HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pi HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "a21461ffd39aa2e46dab62343fb22d0ac244b76b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.436824954253218, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8002, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "a4a71f838a16aff83a3b81efe5546f22b307d507", "event_fingerprint": "63d1cb25a8e76c83e6bc6529fa036d7482a3225d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "18ff7166b42d3b7b4803d26c45ab43ec", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8002, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4pi", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4pi", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b75b387f878d8746d0199f7e2bcb1c7febc1e307", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8002, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8002 \u00b7 (reconnaissance)", "target_port_label": "8002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8002, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8002, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8002 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pi HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 60.22, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8021 · HTTP	http	Scan de ports port scan syn · via HTTP:8021 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8021 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8021, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "bbacb2fd5f84a7eb905f91d7c43c91f735013553", "event_fingerprint": "5e478bb0105051117e5888c66b4719d3f4e881be", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8021, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "51bb4a882bccf7bf8856284ec48ba1081c34efc2", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8021, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8021 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8021, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8021, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8021 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8021" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 60.06, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8003 · HTTP	http	Scan de ports port scan syn · via HTTP:8003 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8003 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ph HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ph HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ph HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "ae31abfb56aac6b75372b6c422ed852ddb880754", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.437272356483075, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8003, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "33909a7ef813add3d63a93f808ab1f3970851d7e", "event_fingerprint": "843eef4b70e442b580300f45c573ff2aa141e410", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "3fe8c6791b4e502d2b61bbaa627081a9", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8003, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ph", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ph", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77716da940c87176e8864b4f4b42210e4aafb2f0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8003, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8003 \u00b7 (reconnaissance)", "target_port_label": "8003 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8003, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8003, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8003 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ph HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8003 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8003" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 59.8, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8021 · HTTP	http	Scan de ports port scan syn · via HTTP:8021 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8021 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4px HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4px HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4px HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "f43bd8f3cfc34d28c6fe5b6e2e91dcc279969604", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.4417455559817025, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8021, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 51, "tag_count": 5, "anomaly_count": 0, "campaign_key": "180eedfa4e0941a92dda05de06c4655246fa74e1", "event_fingerprint": "3bacbda34ce6b920d0f7345ea24d8ce773784727", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "abc9290829915238ea86d4439291bd78", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8021, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4px", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4px", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1627ae5aaa349d4772172ecb450c8ec7a93715d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8021, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance)", "target_port_label": "8021 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 51, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8021, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8021, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4px HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8021 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8021" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 59.55, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	9000 · HTTP	http	Scan de ports port scan syn · via HTTP:9000 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pr HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pr HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4pr HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "01c9c80efb5b55666fb75865a2a0f8099b925ad8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.4377696658419366, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 9000, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "7cd4c941d42720d9c62384e9fe5f6241589b76a9", "event_fingerprint": "d76d72a94524be9355350b31392d7633a79d682f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "ab8c465f4215cec895b577fa89402994", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 9000, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4pr", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4pr", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e017d48d83b77e6a1d0f8d4b1e031b237588988d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 9000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:9000 \u00b7 (reconnaissance)", "target_port_label": "9000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 9000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9000 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4pr HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "9000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 59.29, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ], "behavior_alert_count": 1, "behavior_priority": 84 }
20/07/2026 06:55:45 UTC	TCP	8007 · HTTP	http	Scan de ports port scan syn · via HTTP:8007 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8007 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4po HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4po HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Win Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4po HTTP/1.1 Host: check.proxypool.sh User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Accept: application/json,/ C Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "17b7f2f5ca16d0169999ee51421b7189155e27ff", "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "bc50079d09d69d86855f973b8e481cce68f749a1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 323, "payload_entropy": 5.434058786184543, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8007, "risk_waf": 72, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "beb49f64b2437e9af67d8f546e035590ba0db9e2", "event_fingerprint": "0539f32abbc5c347f16da99864e1c48725d1d1eb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "f9d9e5fc7a9e5166686bdd114f129703", "payload_hash": "08294b26408bed7c58569776a0965012", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8007, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4po", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4po", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36\r\nAccept: application\/json,\/\r\nC", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1c64a5bed3886e2f3c22c193e40c1cdc636d99d4", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8007, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance)", "target_port_label": "8007 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8007, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/149.0.0.0 Safari\/537.36", "port": 8007, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4po HTTP\/1.1\r\nHost: check.proxypool.sh\r\nUser-Agent: Mozilla\/5.0 (Win", "target_port_label": "8007 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8007" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 59.04, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8010 · HTTP	http	Scan de ports port scan syn · via HTTP:8010 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8010 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8010, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "394c01244fa5903b033f88eb1348c84b85515789", "event_fingerprint": "7c2377bd73a44562b8084dc3373afcc0d2f95842", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8010, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7323e2ccd2cb4b2c51757f8e986508641ff17fd5", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8010, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8010 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8010, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8010, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8010 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8010" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 58.88, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }
20/07/2026 06:55:45 UTC	TCP	8007 · HTTP	http	Scan de ports port scan syn · via HTTP:8007 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8007 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 105, "payload_entropy": 4.899221447331217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8007, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cef12f8a07b675da082dd48caeb609200a9141dd", "event_fingerprint": "884a31cb386111fd3f38091b661702983452470c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "9c57ea0133d6862def4e777f24e80e7b", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8007, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a8aa73bdfd3b9466dbd61c90642624f359352534", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8007, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8007 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8007, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8007, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8007 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8007" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 133, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 133, "scan_velocity_ports_per_s": 58.73, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 50, "multi_protocol_sample": [ "bitcoin", "consul", "couchbase", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_flood" ] }

45.153.34.89

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence