|
|
TCP |
4153
|
—
|
Scan de ports
port scan syn · port 4153 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4153
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 4153,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9e9f86dea94898a2a2029040d0acea674a6256ee",
"event_fingerprint": "bc23b7d6a5b902e138adb39177136f03cd03737a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4153,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6b08f7be2ca0c6e05324836a430fd7c7add3872",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 4153
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 4153 \u00b7 (reconnaissance)",
"target_port_label": "4153",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (27 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 4153,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 4153
},
"attack_vector": "port scan syn \u00b7 port 4153 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "4153",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4153"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 77,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 77,
"scan_velocity_ports_per_s": 91.25,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 27,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1082",
"port:1086"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
1096
|
—
|
Scan de ports
port scan syn · port 1096 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1096
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1096,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e6a45f4d6ea090da0a15fba3e209be5932918a79",
"event_fingerprint": "4f14bf47ab5f80ed16457f5ff7b9586c6a7d3ea9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1096,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a3ac077a1fb893ba0973822937e9cec5531688f",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1096
},
"attack_vector": "port scan syn \u00b7 port 1096 \u00b7 (reconnaissance)",
"target_port_label": "1096",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (27 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1096,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1096
},
"attack_vector": "port scan syn \u00b7 port 1096 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1096",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1096"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 77,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 77,
"scan_velocity_ports_per_s": 91.05,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 27,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1082",
"port:1086"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1081
|
—
|
Scan de ports
port scan syn · port 1081 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e721022ebd598ee226909e36f816b9be107d4cf1",
"event_fingerprint": "5b5970c23349ad1a0d59675fa4a85ab73bd663a9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1081,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "795b527503703c0f14aff65634f0fcce330a9cce",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1081
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 1081 \u00b7 (reconnaissance)",
"target_port_label": "1081",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1081
},
"attack_vector": "port scan syn \u00b7 port 1081 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1081",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 77,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 77,
"scan_velocity_ports_per_s": 90.84,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
10000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:10000 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10000
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ci HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ci HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ci HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 126,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "3a94eb2e9d0bda3a1b3239124b89ae35b0904f95",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.003310330047751,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 10000,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "40a5dd2cac8ed49a4131bced14fb105fb877c8b3",
"event_fingerprint": "70a874a3741f36e4db7fae372971b59771fbb2db",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "18155d17afdaa5c87aa19c3568f2dcb5",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 10000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ci",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ci",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac7f96feef36416641fc52564a193f6c59b17f13",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1",
"port": 10000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance)",
"target_port_label": "10000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1",
"port": 10000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ci HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "10000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 78,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 78,
"scan_velocity_ports_per_s": 91.22,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9040 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9040 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9040
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9040,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2eaaf1d510e8cdd4b1e21605f4d1117306c21a7d",
"event_fingerprint": "b404f853ca95e4be8d98d8f635eb94fcc9ee106a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 9040,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15a35b57a1bf5fc7440710b5e4be89410a41abaf",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9040,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9040 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "9040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9040,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9040,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9040 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "9040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9040"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 79,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 79,
"scan_velocity_ports_per_s": 91.86,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8100 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8100 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8100
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8100,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "caf76b88f0cc17f6a844f440ff8e028e2797f4ff",
"event_fingerprint": "fe25c8741928099cc4188f740287fe851364c671",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8100,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10c2186e4d37ffa952d308905816b334dfaa492b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8100 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8100,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8100 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 80,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 80,
"scan_velocity_ports_per_s": 92.51,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8118 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8118 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8118
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8118,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "da770e2414e3df4f094e35f663b8e8596ddedeb2",
"event_fingerprint": "cea2ce263d5fa75e3e8955df5fc0a7c940d5453c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8118,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e8d23819ea9d8359a18b03f6f6e956c645864ee",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8118,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8118 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8118 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8118,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8118,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8118 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8118 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 80,
"port_scan_ports_sample": [
81,
82,
83,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180,
3127
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 80,
"scan_velocity_ports_per_s": 92.01,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
84 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:84 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
84
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bs HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bs HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bs HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "4b0e2ee88ba6d4f3411888f8af91d502ca7ef20b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.014454001132744,
"port_category": "well_known",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 84,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d9c91033f66637cb13510e8d07b16e53b555f229",
"event_fingerprint": "b06c74598a1df21934c7f452d5465e6e9275e6bc",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "26e1e6cb0afcbdfb433d398c2b0ba7c1",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 84,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4bs",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4bs",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69cc04f67aa38f57492a2b974121d445fd145c7e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1",
"port": 84,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:84 \u00b7 (reconnaissance)",
"target_port_label": "84 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 84,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1",
"port": 84,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:84 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "84 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "84"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 81,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 81,
"scan_velocity_ports_per_s": 92.38,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8010 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8010 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8010
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8010,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac07450c204b8071a7f348e82f7610182679e2ff",
"event_fingerprint": "6d3d9681b6dc1ceff3ac0aaffd6a524cb4415d9d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8010,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1fc78cf3b8489e22b6d28f288732437c86171151",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 82,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 82,
"scan_velocity_ports_per_s": 93.01,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
10800
|
—
|
Scan de ports
port scan syn · port 10800 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10800
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 10800,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "dff902cccdd4ced845e336cc71e295c25d974771",
"event_fingerprint": "0d2359970467ee01921410d4ffc3668c65125908",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 10800,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23be0b1a7c38e9596b6981c15cae7f3bc066f327",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 10800
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 10800 \u00b7 (reconnaissance)",
"target_port_label": "10800",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 10800,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 10800
},
"attack_vector": "port scan syn \u00b7 port 10800 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "10800",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10800"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 82,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 82,
"scan_velocity_ports_per_s": 92.78,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
1081
|
—
|
Scan de ports
port scan syn · port 1081 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f46ff2bdcd6bcf48decbc27977a3f3f41f7e2e6a",
"event_fingerprint": "5b5970c23349ad1a0d59675fa4a85ab73bd663a9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1081,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ec2c01696238624128de6560eb011dde77afacf",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1081
},
"attack_vector": "port scan syn \u00b7 port 1081 \u00b7 (reconnaissance)",
"target_port_label": "1081",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1081
},
"attack_vector": "port scan syn \u00b7 port 1081 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1081",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 82,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 82,
"scan_velocity_ports_per_s": 92.55,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
10000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:10000 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
10000
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 126,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 10000,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c184bfe5ff6b196c90866ee749bb4e42c038a580",
"event_fingerprint": "cb284e7634694cf60590dfe2766e022bad637864",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 10000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b4d6dacf5d43a9a56f6218e672bc17c539bbfc0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 10000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "10000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 10000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "10000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 82,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 82,
"scan_velocity_ports_per_s": 92.05,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8022 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8022 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8022
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8022,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2b0b16730c062f3341cb0ddf082267496bac6c7a",
"event_fingerprint": "58df84c603939a0a98be2f0e355361b88b96ba01",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8022,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b058efef3dde840a7ec6790f45bb9e5b1305600a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8022 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8022 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 83,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 83,
"scan_velocity_ports_per_s": 92.68,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9000 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9000
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ce HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ce HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ce HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "add0cd6203af1429492ca19794843138274816e3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 4.994440795481734,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9000,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0a2b53814079c389021b482f4254bb2f51856401",
"event_fingerprint": "e13a962038ea5f97836e61afaa55ea0c30f85bea",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f838271de3ba75c58f304a2379276ee1",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ce",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ce",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15e89e88309b4ce77d654e9f326fc9ff37c32f53",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9000 \u00b7 (reconnaissance)",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9000 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ce HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 83,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 83,
"scan_velocity_ports_per_s": 91.92,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9000 · (reconnaissance) · → N
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
" N
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
net_port_scan_fast
net_slowloris
Cible HTTP
"
N
TLS SNI
—
Capteur
paris-1
|
Méthode
"
Port
9000
Chemin / cible
N
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
Ligne de requête
" N HTTP/1.1
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "e42e8bb820d4f7550a0f04619f4e15fdc56943b9",
"http_referer_hash": null,
"http_method": "\u0004\u0001\u0001\"",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9000,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cdd07888f22d3457616a595330e726a942281107",
"event_fingerprint": "0b10e1e414b2f74db73e14d123ebc6222dfec0b8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554"
],
"matched_pattern_names": [
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "481daf8515fdae90077119892b048315"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"method": "\u0004\u0001\u0001\"",
"path": "N\u0000",
"request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"method": "\u0004\u0001\u0001\"",
"path": "N\u0000",
"request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b27b951310260abf8b5f96687e10472c9d76819",
"protocol_details": {
"http_method": "\u0004\u0001\u0001\"",
"http_path": "N\u0000",
"request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 via HTTP:9000 \u00b7 (reconnaissance) \u00b7 \u2192 N\u0000",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "\u0004\u0001\u0001\"",
"http_path": "N\u0000",
"request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9000 \u00b7 (reconnaissance) \u00b7 \u2192 N\u0000",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 83,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 83,
"scan_velocity_ports_per_s": 91.61,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua",
"net_port_scan_fast",
"net_slowloris"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Scan de ports
port scan syn · via SOCKS5:1080 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
�" �N
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "socks5",
"app_proto": "socks5",
"asn": 197170,
"country": "NL",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5a2125b20e726bc61318b2f59fa4f84147b8c13a",
"event_fingerprint": "dc2e01e414bde3aa47dfa7a38a4e4393eddba8cb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "edd4978b0c241ea6a52d7238bbd735e8f70c7873",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 via SOCKS5:1080 \u00b7 (reconnaissance)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SOCKS5 \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "port scan syn \u00b7 via SOCKS5:1080 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 83,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 83,
"scan_velocity_ports_per_s": 91.41,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
7890
|
—
|
Scan de ports
port scan syn · port 7890 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7890
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 7890,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ce0642c1a6e39e042d9c878b53b1530fe2107e31",
"event_fingerprint": "f0a174519bba85d4fd9d293b0674fe181e8a815f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7890,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43209c636ec0e9da56979f7971703a5a684615bd",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 7890
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 7890 \u00b7 (reconnaissance)",
"target_port_label": "7890",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7890,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 7890
},
"attack_vector": "port scan syn \u00b7 port 7890 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "7890",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7890"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 83,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 83,
"scan_velocity_ports_per_s": 91.21,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
9040 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9040 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9040
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d4 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d4 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d4 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "df5b2bf318b269dc62ae4bf52c75eecade893ec9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369292,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9040,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3b5316cc684c6c69248863304c4020066f4fe7b1",
"event_fingerprint": "126fb0b46b40401e870fecc1dd3409f43a546cf2",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a8d153be760ef4bae2f1693156774d68",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9040,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d4",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d4",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4952b547f7873debcb6897f7b1a7b736d2d0c30",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1",
"port": 9040,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9040 \u00b7 (reconnaissance)",
"target_port_label": "9040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (28 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9040,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1",
"port": 9040,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9040 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9040"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 83,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1096,
1180
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 83,
"scan_velocity_ports_per_s": 90.48,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 28,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1094
|
—
|
Scan de ports
port scan syn · port 1094 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1094
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1094,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ff0b83fc1f53bc006e71e3f7e65cac874c1ee6dd",
"event_fingerprint": "2ce55ae60b7e62d9537e120e6ac1de9ad54d974a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1094,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e22a352dfea05da06371573340cbb2ae2b2e77b",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1094
},
"attack_vector": "port scan syn \u00b7 port 1094 \u00b7 (reconnaissance)",
"target_port_label": "1094",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (29 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1094,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1094
},
"attack_vector": "port scan syn \u00b7 port 1094 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1094",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1094"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 84,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1094,
1096
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 84,
"scan_velocity_ports_per_s": 91.38,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 29,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
7070
|
—
|
Scan de ports
port scan syn · port 7070 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7070
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 7070,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a184d5634e12c04260748fe098d2b2387e843a73",
"event_fingerprint": "011e338dd1e99f0a54c02829e67162563b77dbef",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7070,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd58085029cc7012d25bc86daf8c6c6525e3fea9",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 7070
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 7070 \u00b7 (reconnaissance)",
"target_port_label": "7070",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (30 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7070,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 7070
},
"attack_vector": "port scan syn \u00b7 port 7070 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "7070",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7070"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 85,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1089,
1091,
1092,
1093,
1094,
1096
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 85,
"scan_velocity_ports_per_s": 92.23,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 30,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
1088
|
—
|
Scan de ports
port scan syn · port 1088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1088
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "69719454cefeca0cd94ce9b8fb917e26ecacb6dd",
"event_fingerprint": "1239ae2c57e26fc98fadd90389dc449932bdda6c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1088,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af208fe2c0d2366953c8081e6205129334f524ea",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1088
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"target_port_label": "1088",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1088
},
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1088",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 86,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 86,
"scan_velocity_ports_per_s": 93.09,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
10080 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:10080 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cm HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cm HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cm HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "b1a19a729fa4e58de09c08de513ec385ee7f2c68",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.009728435706702,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 10080,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1d296c5d5b1026363f46c80dfb57fc737316fc27",
"event_fingerprint": "adbfc248e7bc2b1015e348493d685f2cebc71c7b",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "840ef82e39c161ad973f78debd013616",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 10080,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cm",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cm",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c69b8be7a8b6d69601b15252784a5e3919d79f7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1",
"port": 10080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:10080 \u00b7 (reconnaissance)",
"target_port_label": "10080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10080,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1",
"port": 10080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10080 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cm HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "10080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 87,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 87,
"scan_velocity_ports_per_s": 93.37,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8898 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8898 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8898
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8898,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c2bd05b5f93834814f39f0469e49a2aca3c82e5e",
"event_fingerprint": "30d5e3b804531645e63661d3d4ad35abb5916fe5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8898,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "32b75cae42f4f11e6926ca6f8e42fbf786aa8954",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8898,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8898 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8898 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8898,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8898,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8898 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8898 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8898"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 88,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 88,
"scan_velocity_ports_per_s": 93.97,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8007 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8007 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8007
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cq HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cq HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "8f67466850a9ebb606cac715a2d501a2f989879c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.020037714057217,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8007,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "865cbb4c254cf0eb95f6e30f754f9f2a14185e6b",
"event_fingerprint": "e7d7a3c1fa8ec3813593d19cb9cc9b42518eebe2",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "410827229a72ae271b8527c597a5fda5",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8007,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cq",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cq",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97e03bf83af8207a69d8f08992b4c301605c5c28",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1",
"port": 8007,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance)",
"target_port_label": "8007 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8007,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1",
"port": 8007,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8007 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 89,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 89,
"scan_velocity_ports_per_s": 94.26,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1088
|
—
|
Scan de ports
port scan syn · port 1088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1088
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0933d86277308ac3139aad04628c9c7a1d2df02e",
"event_fingerprint": "1239ae2c57e26fc98fadd90389dc449932bdda6c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1088,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ad0c12ce9669b028a5ec69cf1ba3be9364e5d48",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1088
},
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"target_port_label": "1088",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1088
},
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1088",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 89,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 89,
"scan_velocity_ports_per_s": 94.04,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8021 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8021 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8021
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8021,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ccc00508bffdd33813f10a836c3db26695090110",
"event_fingerprint": "76647dc7c9e80cba8e0e72c184dd4d7e0608ca14",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8021,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8cad53d0c31d7a1f0c5b06d9748b5b4a5d1a396a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8021,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8021"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 90,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 90,
"scan_velocity_ports_per_s": 94.61,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9088 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9088 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9088
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e89f1c165a4376bb72badccd745e6870656f0f02",
"event_fingerprint": "48157ae0ab831f7386a002664901a80ab4188773",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 9088,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff029cf872d7842e5d0c24bd0be4571a5661066c",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9088,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "9088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (31 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9088,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "9088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 91,
"port_scan_ports_sample": [
81,
82,
83,
84,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093,
1094
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 91,
"scan_velocity_ports_per_s": 95.2,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 31,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"port:10800",
"port:1081",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Scan de ports
port scan syn · via KERBEROS:88 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "well_known",
"org": "TechTies Inc.",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 197170,
"country": "NL",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a0bbcb32db0850167ba7a2ea9d9008ae93140003",
"event_fingerprint": "913d44813db075acdef68e978cb3225e3e208a9e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b2a16187de58fc072e61505a6577c14962f073e",
"protocol_details": {
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KERBEROS \u2014 multi-protocole (32 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 92,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 92,
"scan_velocity_ports_per_s": 95.91,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 32,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|
|
|
TCP |
9010 · Webhook Discord
|
discord-webhook
|
Scan de ports
port scan syn · via Webhook Discord:9010 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
DISCORD-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
discord_webhook_emulated
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9010
Chemin / cible
—
Service
Webhook Discord
Payload
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cj HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cj HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cj HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420646973636f72645f776562686f6f6b20726561647920706f72743d393031300d0a",
"emulator_response_len": 46,
"bytes_in": 194,
"payload_entropy": 5.009728435706702,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "discord-webhook",
"app_proto": "discord-webhook",
"asn": 197170,
"country": "NL",
"dst_port": 9010,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "36a916c36921e211294dc045527ba4aa694b8344",
"event_fingerprint": "39d54594e701e244c2723caf635668e85cc5977e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "discord-webhook",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "181070c5a1aa1b59964b0903669601fd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9010,
"service": "discord-webhook",
"service_name": "discord-webhook",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5463350d61a701817681c59d5d7250c010ce6a93",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 9010,
"service": "discord-webhook",
"service_label_fr": "Webhook Discord"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
"target_port_label": "9010 \u00b7 Webhook Discord",
"emulator_service": "discord-webhook",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook Discord \u2014 multi-protocole (32 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "discord-webhook",
"service_label_fr": "Webhook Discord",
"dst_port": 9010,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-discord-webhook",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 9010,
"service": "discord-webhook",
"service_label_fr": "Webhook Discord"
},
"attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9010 \u00b7 Webhook Discord",
"emulator_service": "discord-webhook",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "discord_webhook",
"service_banner": "honeypot-discord-webhook",
"service_os": "linux",
"dst_port": "9010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 92,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 92,
"scan_velocity_ports_per_s": 95.42,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 32,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"discord_webhook_emulated",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8898 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8898 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8898
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ct HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ct HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ct HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "f8de843a5dfcfda46035c9d0cba6385b64262557",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 4.996690677907831,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8898,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0c39bd24c319f190ac282c16a92829438362d34f",
"event_fingerprint": "9503feb62c274ba15bf37d9a6815e745cd1f4847",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c8005a769609eb703da5e94631bf238e",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8898,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ct",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ct",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00d1b6bc5e64a4177a25ee2a2598a7f4f6d8efe0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1",
"port": 8898,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8898 \u00b7 (reconnaissance)",
"target_port_label": "8898 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (32 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8898,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1",
"port": 8898,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8898 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ct HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8898 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8898"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 92,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1086,
1087,
1088,
1089,
1091,
1092,
1093
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 92,
"scan_velocity_ports_per_s": 94.69,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 32,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1085
|
—
|
Scan de ports
port scan syn · port 1085 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1085
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1085,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "51b1db623b7aaad946a34fceee8def3e9ee6a454",
"event_fingerprint": "9e602bc1bf8d2c99ba9706669905bc6d6505d056",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1085,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcd37cc0576527316bf493fe46bb74b4572aa7c0",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1085
},
"attack_vector": "port scan syn \u00b7 port 1085 \u00b7 (reconnaissance)",
"target_port_label": "1085",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (33 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1085,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1085
},
"attack_vector": "port scan syn \u00b7 port 1085 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1085",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 93,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 93,
"scan_velocity_ports_per_s": 95.52,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 33,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8007 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8007 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8007
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8007,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "43f35e2ab562dc1f63ad14e2262b020553ede873",
"event_fingerprint": "21fb281e07341c4383571e81acdb41eb6c06593e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8007,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3bbd4f5a9d7ab80238dfbcf17316ebc67c4c8810",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8007,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8007 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (33 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8007,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8007,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8007 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8007 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 93,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 93,
"scan_velocity_ports_per_s": 94.92,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 33,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8022 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8022 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8022
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cg HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cg HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cg HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "24cba46330e24b6b026173c74791956ce3a7fd62",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.009728435706702,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8022,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a4034afab8345b65885db5f7e39ee05b6242e821",
"event_fingerprint": "36e610806d139f67836ecafd180c6a9e1f6a2601",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bd4ca33cf22db6bad2b0ed87bd1b84a3",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8022,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cg",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cg",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "582452b76d4400d85c0e119845f324fe8c040c7c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1",
"port": 8022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8022 \u00b7 (reconnaissance)",
"target_port_label": "8022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (33 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1",
"port": 8022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8022 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 93,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 93,
"scan_velocity_ports_per_s": 94.18,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 33,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8191 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8191 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8191
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dg HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dg HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dg HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "a73356b9ce70e4bf0e994ce3793d50962e8fc141",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.038448960060856,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8191,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e9c9bc9d581391b8a648641a0b89cb4425171b22",
"event_fingerprint": "499e98993e020594366ce2dbcbda9e8f8fac0009",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81ebce202af09215d3a29f3c02e9f067",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8191,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4dg",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4dg",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "315c6aaddece05ceaf4ece87407b222f67e63f33",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1",
"port": 8191,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8191 \u00b7 (reconnaissance)",
"target_port_label": "8191 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (33 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8191,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1",
"port": 8191,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8191 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dg HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8191 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8191"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 94,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 94,
"scan_velocity_ports_per_s": 94.46,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 33,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kerberos",
"port:10800",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9091 · KAFKA JMX
|
kafka-jmx
|
Scan de ports
port scan syn · via KAFKA JMX:9091 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
KAFKA-JMX
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9091
Chemin / cible
—
Service
KAFKA JMX
Payload
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dc HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dc HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dc HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a",
"emulator_response_len": 40,
"bytes_in": 194,
"payload_entropy": 5.020037714057217,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "kafka-jmx",
"app_proto": "kafka-jmx",
"asn": 197170,
"country": "NL",
"dst_port": 9091,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0b05a5c74c13e8c5b12f5b65c82dd02efa2a1023",
"event_fingerprint": "ce2c4f2c3ed924aedc3da83d66dd2d0ca13b4808",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "kafka-jmx",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "18ab75a938351e207061bdb1c3bd2fcb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9091,
"service": "kafka-jmx",
"service_name": "kafka-jmx",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bb96735a8e17a05cf78994897003d666e93c360",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 9091,
"service": "kafka-jmx",
"service_label_fr": "KAFKA JMX"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via KAFKA JMX:9091 \u00b7 (reconnaissance)",
"target_port_label": "9091 \u00b7 KAFKA JMX",
"emulator_service": "kafka-jmx",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KAFKA JMX \u2014 multi-protocole (34 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kafka-jmx",
"service_label_fr": "KAFKA JMX",
"dst_port": 9091,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-jmx",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 9091,
"service": "kafka-jmx",
"service_label_fr": "KAFKA JMX"
},
"attack_vector": "port scan syn \u00b7 via KAFKA JMX:9091 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9091 \u00b7 KAFKA JMX",
"emulator_service": "kafka-jmx",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_jmx",
"service_banner": "honeypot-kafka-jmx",
"service_os": "linux",
"dst_port": "9091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 95,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 95,
"scan_velocity_ports_per_s": 94.96,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 34,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|
|
|
TCP |
1097
|
—
|
Scan de ports
port scan syn · port 1097 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1097
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1097,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6f2a86b435c478fcaa799ded2209dcb750b6d55f",
"event_fingerprint": "32f76d844c75d217bf8c0f4d54a2f8a569fc815c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1097,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad083846a14bc611b99d64ee6f425c083945b025",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1097
},
"attack_vector": "port scan syn \u00b7 port 1097 \u00b7 (reconnaissance)",
"target_port_label": "1097",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (35 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1097,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1097
},
"attack_vector": "port scan syn \u00b7 port 1097 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1097",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1097"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 96,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 96,
"scan_velocity_ports_per_s": 95.76,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 35,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8026 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8026 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8026
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8026,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f8d206c71ad119d9a2bdd40bc440c9f65b400bee",
"event_fingerprint": "1a0ba1aeec91fba46a8f4c25ea9171d79a4d9b1d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8026,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a2d140c3fe8aac34c7a3393034c5d9dc93e7601",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8026,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8026 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8026 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (35 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8026,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8026,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8026 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8026 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8026"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 97,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 97,
"scan_velocity_ports_per_s": 96.29,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 35,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9090 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9090 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9090
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d2 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d2 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d2 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2036360d0a0d0a232048454c502075702031206966207461726765742069732075702e0a2320545950452075702067617567650a75707b",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "0df3fc9d1101c129b547214a7d25125eef73abce",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369292,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9090,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c28a281e1e320f7e5ed9b686f296f9093ffb2039",
"event_fingerprint": "af64a54a660c6f295ce44e4c7e2fddf562f42272",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df2aa477615b19c763559d55306a6841",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9090,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d2",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d2",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1cf7e9783b92533d1ece602e2fad86b1f3b87316",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1",
"port": 9090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9090 \u00b7 (reconnaissance)",
"target_port_label": "9090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (35 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9090,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1",
"port": 9090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9090 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 98,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 98,
"scan_velocity_ports_per_s": 96.53,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 35,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9080 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7d846e078a806db76a598bfa494bcd7431f8fcbd",
"event_fingerprint": "10c54c8037981d951be5393d4e71d0bf7831865a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b91f7762d5e41b61c76d477472a60718fe88c4d6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9080 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (35 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9080 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 99,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 99,
"scan_velocity_ports_per_s": 97.04,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 35,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9080 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d3 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d3 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d3 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "70bb814e3d9d3f5dc3067c9e0d4972a2785fe090",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.0384489600608555,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9080,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "74c44093038808bce3c9aa524900a893dc930f6c",
"event_fingerprint": "b92385c466bea23ae636fc5169164b970300564c",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "34a920d78b4d34d56bb3bf1c726b41f7",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d3",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d3",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a42b928688cd86bad210f5e63a70678516ca763",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9080 \u00b7 (reconnaissance)",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (35 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9080 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 99,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 99,
"scan_velocity_ports_per_s": 96.27,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 35,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Scan de ports
port scan syn · via SOCKS5:1080 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "socks5",
"app_proto": "socks5",
"asn": 197170,
"country": "NL",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "26b38bfcba7e5e5c76a8fd6479a79ae500391369",
"event_fingerprint": "dc2e01e414bde3aa47dfa7a38a4e4393eddba8cb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a299a29df120dd5456eec9711a82485a6a1847b2",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "port scan syn \u00b7 via SOCKS5:1080 \u00b7 (reconnaissance)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SOCKS5 \u2014 multi-protocole (35 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "port scan syn \u00b7 via SOCKS5:1080 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 99,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 99,
"scan_velocity_ports_per_s": 96.07,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 35,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
1098
|
—
|
Scan de ports
port scan syn · port 1098 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1098
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1098,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "046393a4402099dac8d158f2c4fbc5dd208900bc",
"event_fingerprint": "1bce92aaa9800912216a3960c61a63a5aa9badc0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1098,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31c6d6d948a90cf10bb4098a288156f1d399d1e7",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1098
},
"attack_vector": "port scan syn \u00b7 port 1098 \u00b7 (reconnaissance)",
"target_port_label": "1098",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (36 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1098,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1098
},
"attack_vector": "port scan syn \u00b7 port 1098 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1098",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 100,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 100,
"scan_velocity_ports_per_s": 96.87,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 36,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1097
|
—
|
Scan de ports
port scan syn · port 1097 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1097
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1097,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "472b6d36dfe657758862210146e24cad44360621",
"event_fingerprint": "32f76d844c75d217bf8c0f4d54a2f8a569fc815c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1097,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a8082a73c26715192ae7ae0dbe0deb8b695c1da",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1097
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 1097 \u00b7 (reconnaissance)",
"target_port_label": "1097",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (36 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1097,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1097
},
"attack_vector": "port scan syn \u00b7 port 1097 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1097",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1097"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 100,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 100,
"scan_velocity_ports_per_s": 96.67,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 36,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
8021 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8021 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8021
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dd HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dd HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dd HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "a7c3baae2852447bebb4efdd5046af88a9dabeea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.0384489600608555,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8021,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a4303c2fa72f88997db6c915bf2dc9eb7a7a119c",
"event_fingerprint": "57a1f4d338f2f1691cda637c4579999503e0682e",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8dd679a4e9d502546385d1f6e99a32d0",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8021,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4dd",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4dd",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51d5b607c1df2430e7830e69016677f96c98029e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance)",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (36 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8021,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8021 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dd HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8021"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 100,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 100,
"scan_velocity_ports_per_s": 95.94,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 36,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"kafka-jmx",
"kerberos",
"port:10800"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1099 · JAVA RMI
|
java-rmi
|
Scan de ports
port scan syn · via JAVA RMI:1099 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
JAVA-RMI
WAF
—
Recommandation
Surveiller
Tags
java_rmi_emulated
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1099
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4e001550726f746f636f6c00044a524d4900004b000000020000",
"emulator_response_len": 26,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "java-rmi",
"app_proto": "java-rmi",
"asn": 197170,
"country": "NL",
"dst_port": 1099,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3fcb9db6bb802c379181d0693df6a5ef86010754",
"event_fingerprint": "be1ab063e00af3bbe1f75b03681a793f5b63004f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "java-rmi",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1099,
"service": "java-rmi",
"service_name": "java-rmi",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35e43ad0e5ad4a703351d97d9adf44f43f560b7c",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1099,
"service": "java-rmi",
"service_label_fr": "JAVA RMI"
},
"attack_vector": "port scan syn \u00b7 via JAVA RMI:1099 \u00b7 (reconnaissance)",
"target_port_label": "1099 \u00b7 JAVA RMI",
"emulator_service": "java-rmi",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via JAVA RMI \u2014 multi-protocole (37 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "java-rmi",
"service_label_fr": "JAVA RMI",
"dst_port": 1099,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-java-rmi",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1099,
"service": "java-rmi",
"service_label_fr": "JAVA RMI"
},
"attack_vector": "port scan syn \u00b7 via JAVA RMI:1099 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1099 \u00b7 JAVA RMI",
"emulator_service": "java-rmi",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "java_rmi",
"service_banner": "honeypot-java-rmi",
"service_os": "linux",
"dst_port": "1099"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 101,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 101,
"scan_velocity_ports_per_s": 96.7,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 37,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"kafka-jmx",
"kerberos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"java_rmi_emulated",
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8014 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8014 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8014
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8014,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "01aa0f84fe19e39d4c55de606240792c0f59b626",
"event_fingerprint": "5790d2af4fc0bb506101a1f64d83bd8b904f912d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8014,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "242c874606156cf13b2606648a357e9043f50ce7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (37 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8014,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8014"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 102,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 102,
"scan_velocity_ports_per_s": 97.21,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 37,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"kafka-jmx",
"kerberos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9008 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9008 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9008
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9008,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0488b8984fd5e6a3185f48dd8d105fa4bf469c7f",
"event_fingerprint": "25a721c3454f9c1d8b5eeb370eda312120d78b56",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 9008,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93fc84831b2c6ed0c7763f30686bf95bcf1d73ee",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (37 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9008,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 103,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1091,
1092
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 103,
"scan_velocity_ports_per_s": 97.71,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 37,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"kafka-jmx",
"kerberos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1090
|
—
|
Scan de ports
port scan syn · port 1090 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1090
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1090,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "7e22373a826e49b8a4473435431c8dd34a8e4b2a",
"event_fingerprint": "5498c8e196a7456f5d916b9e88341ac59507d55e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1090,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "009d26c62865182597d19197db2ab3373adbba7d",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1090
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 1090 \u00b7 (reconnaissance)",
"target_port_label": "1090",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (38 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1090,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1090
},
"attack_vector": "port scan syn \u00b7 port 1090 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1090",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 104,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 104,
"scan_velocity_ports_per_s": 98.47,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 38,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"kafka-jmx",
"kerberos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks4_greeting"
]
}
|
|
|
TCP |
8018 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8018 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_port_scan_fast
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8018
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8018,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4b8a9831eaf420b02b0014bbc13a9b80ce6566ce",
"event_fingerprint": "03f15db3d3a59ac465ecd2cb788312eb549e9b67",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8018,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b7e9ddf9f2037cd831f63a296d9af610d425dee",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8018,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8018 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (38 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8018,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8018,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8018 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8018"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 105,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 105,
"scan_velocity_ports_per_s": 98.97,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 38,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"kafka-jmx",
"kerberos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9999 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9999 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9999
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4df HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4df HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4df HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "3923a00ed3d5e025b17756f0c22d6b557f3e54b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369291,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9999,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "69e4d3379514575b5a0ded5ace5c1cd7bbf28860",
"event_fingerprint": "cac309a7044b5ae484c7d1b440e1c117375827be",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b88a2634e7c90e472ec830d839ab99f",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4df",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4df",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "231ff7be2201eb22d9d60eba8b7473218a113554",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (38 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4df HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 106,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 106,
"scan_velocity_ports_per_s": 99.17,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 38,
"multi_protocol_sample": [
"bitcoin",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"kafka-jmx",
"kerberos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_port_scan_fast"
]
}
|