|
|
TCP |
8071 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8071 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8071
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s1 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s1 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s1 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "b79bd9bebecae0efb90b99787448affea8b72487",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.010048057976696,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8071,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4ce1791327e739cee4dda0df20047dbad8137e11",
"event_fingerprint": "2a0f6021ddd590d364894be5bc5e38359d3b24d5",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "549e5b90667cc01e16c598684a3beedb",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8071,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4s1",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4s1",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09177b423837dfd409209ac566b0cd8e3d5c9b7c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1",
"port": 8071,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8071 \u00b7 (reconnaissance)",
"target_port_label": "8071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1",
"port": 8071,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8071 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 50.2,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1088
|
—
|
Scan de ports
port scan syn · port 1088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1088
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b85a938072489679aacfc40ab88925c06e00a213",
"event_fingerprint": "ef823585c31143deab7d8448dfd0c02ec6cc77a2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1088,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4007c6db71e45a6c01b6f255dbb1662c15aa7452",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1088
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"target_port_label": "1088",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1088
},
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1088",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 50.16,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks4_greeting"
]
}
|
|
|
TCP |
9088 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9088
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ry HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ry HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ry HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "5fe5a0d2532255f526c8fefa390d37ec9a721dfd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.014454001132743,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9088,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d2c98bf08d63f9dc855ef5346670dec60edda630",
"event_fingerprint": "6258ef4aa72851ea892c5c5e2078d84308238eaa",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fa98933a3067c7f61d7ba51c730f92f6",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9088,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ry",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ry",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "da06283d6534c017bc0f335cd6969e875d141f4e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1",
"port": 9088,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance)",
"target_port_label": "9088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1",
"port": 9088,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ry HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 49.96,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1094
|
—
|
Scan de ports
port scan syn · port 1094 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1094
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1094,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4648e6ff6bf236f7617bf08fdb63e3d8e6608b7e",
"event_fingerprint": "6a420932d1a1452a0c5eadc18c273f35f2d8593d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1094,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab5d9fa0fe5ff4fef7dc400eec29046b0e86811a",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1094
},
"attack_vector": "port scan syn \u00b7 port 1094 \u00b7 (reconnaissance)",
"target_port_label": "1094",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1094,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1094
},
"attack_vector": "port scan syn \u00b7 port 1094 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1094",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1094"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 49.92,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_greeting"
]
}
|
|
|
TCP |
8013 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8013 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8013
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rv HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rv HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rv HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "1b0e6be266af1f6728db9e9b9f86d387a18a321e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.028654452174824,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8013,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "41bb1e3703800c3d012a55f0979cbdbb93a56a83",
"event_fingerprint": "ad86d6c8512d2bc27c4057ea32c4f488003de5db",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7dec98e9db9b418c5799a0cd607f6deb",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8013,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rv",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rv",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "444fa77a964dac629d638321bb9f2719431305a3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1",
"port": 8013,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8013 \u00b7 (reconnaissance)",
"target_port_label": "8013 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8013,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1",
"port": 8013,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8013 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8013 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8013"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 49.59,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8014 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8014 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8014
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ru HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ru HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ru HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "e47f1195f44516911d005804d9834f1b97d3e822",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.028654452174824,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8014,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0773ff2b7407426acf43732397c2d7c2e02854b7",
"event_fingerprint": "b54b3011912aa4fb444ac581085a2c468ed3cba3",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "414b4d9a148823931c053065bb6d7ce7",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8014,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ru",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4ru",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac872c6b00b4db36a1ec07cb86e2de9d6154c571",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance)",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8014,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ru HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8014"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 49.31,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rp HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rp HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rp HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "37889048d2ad4663dc0dc0a71b351028735fbeab",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.003734519926696,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9002,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f645e68bfb7d63db8afa5272135a6b4da51fbce4",
"event_fingerprint": "27c8a49d0138ee725233d2300bed2e5e1916b3d2",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba30dc63350bcda01a226366b23a9b98",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rp",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rp",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a8b20c202f94c33b248ef4a97eac4d30dc16153",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 48.67,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9052
|
—
|
Scan de ports
port scan syn · port 9052 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9052
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 9052,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "03bea3dae03c9442c0f809468a29cd247d7fb4ad",
"event_fingerprint": "7fd1bbfa53740c1518b0d56c26652b8c878ffd2c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9052,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5dc398baeaef1f121d2a3c7f329255458338221d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9052
},
"attack_vector": "port scan syn \u00b7 port 9052 \u00b7 (reconnaissance)",
"target_port_label": "9052",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9052,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9052
},
"attack_vector": "port scan syn \u00b7 port 9052 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9052",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9052"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 48.5,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_greeting"
]
}
|
|
|
TCP |
10808 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:10808 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10808
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s4 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s4 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s4 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "2763cf69ff987df1653919120b72ec6a2d8a692b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.014454001132744,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 10808,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e64fd1ef0f9f247997bd7304f00335759b8e6937",
"event_fingerprint": "c8b064973d200f84b3b3b97511dbfd7bdf7ea74b",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f44102b9ee529756fe0fb8a40c8c69d",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 10808,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4s4",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4s4",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "410519603def31c6e1418bce4c873f49a124fde0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1",
"port": 10808,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:10808 \u00b7 (reconnaissance)",
"target_port_label": "10808 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10808,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1",
"port": 10808,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10808 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "10808 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10808"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 48.24,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8181 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8181 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8181
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s2 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s2 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4s2 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "4902f5f85d8f914aa8666ab05e18852fe1c7c9a6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.014454001132744,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8181,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b364c7ae549e5871569319d8a2eb3101c6b311a6",
"event_fingerprint": "f383a888c35e746fb6333e27a4cdd932e5999498",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c6b51df61d2d9e11c8ecdbe63b600fa7",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8181,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4s2",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4s2",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13b19ddef7d667f03204a308c68df432cda5cb3e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1",
"port": 8181,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8181 \u00b7 (reconnaissance)",
"target_port_label": "8181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8181,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1",
"port": 8181,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8181 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4s2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 48.11,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1097
|
—
|
Scan de ports
port scan syn · port 1097 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1097
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1097,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "61f18707c93fceaaee9f8400f073df4776ac5e60",
"event_fingerprint": "2be436ee1e07c2bbfa27dfa137668423a51422c9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1097,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cad8f92e4024c24ecb6ef04eb8664d43ceca59fa",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1097
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 1097 \u00b7 (reconnaissance)",
"target_port_label": "1097",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1097,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 1097
},
"attack_vector": "port scan syn \u00b7 port 1097 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "1097",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1097"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 48.07,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks4_greeting"
]
}
|
|
|
TCP |
9008 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9008 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9008
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rx HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rx HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rx HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "63c478a54e7aa8cfb3715d4f95590ac42cb690a6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.014454001132743,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9008,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "470cef20671c3ccb4567a67d6e762d86019a5189",
"event_fingerprint": "0442d35fd97adb5e76304b452dd2bbd09f7fe3b9",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "11d031aedebc93bd15e8558b51ac1d85",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9008,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rx",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rx",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bf59d76dc29d85651272d2f4374b9c8725734ef",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance)",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9008,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 47.93,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1088
|
—
|
Scan de ports
port scan syn · port 1088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1088
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "2dcaf51e48a5293ffa7ace70b617f73a5c705523",
"event_fingerprint": "ef823585c31143deab7d8448dfd0c02ec6cc77a2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1088,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f09282452cd8f875c301ccceaad66048174aceb5",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1088
},
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"target_port_label": "1088",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1088
},
"attack_vector": "port scan syn \u00b7 port 1088 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1088",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 47.8,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_greeting"
]
}
|
|
|
TCP |
8012 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8012 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8012
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rw HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rw HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rw HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "9bca7e7b16db838d5b470d243c6715be202bd8f9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.028654452174824,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8012,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ea47f95da91e8b847075910a80b0e4d5f851f0a1",
"event_fingerprint": "c4db515242bdb7a70f511051e43d38eec61a9b1a",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6a9531c2f09c19de601783ff1967bcf0",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8012,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rw",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rw",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75bc2ebe379227dbd7d05e5ed13ea8e9c65296ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1",
"port": 8012,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance)",
"target_port_label": "8012 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8012,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1",
"port": 8012,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8012 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8012"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 47.66,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
5678 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5678 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5678
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rq HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rq HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4rq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "3fccf37f393f16a58d0248b2336d6f3755b75690",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.028654452174824,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5678,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "09cc3e2527e514b156b91e106999cbb263217d65",
"event_fingerprint": "c46e972cbdff8b658ef60fa4f4aebaf8b4b0d4f4",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d53d0e3db366d3556a23ac9dc2c224b",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 5678,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rq",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4rq",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46245ba736dd3737271a350189ecdcd1d86bcf0c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:5678 \u00b7 (reconnaissance)",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5678 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4rq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 47.27,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1098
|
—
|
Scan de ports
port scan syn · port 1098 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1098
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1098,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "8148e7ca22347a1a20f9f3dddada642c4d750f1d",
"event_fingerprint": "4d981a189f409d9f152f20724c9a215ca62c4b77",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1098,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "426510a83068d2714cc8bfa6d616263bf5771b13",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1098
},
"attack_vector": "port scan syn \u00b7 port 1098 \u00b7 (reconnaissance)",
"target_port_label": "1098",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1098,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1098
},
"attack_vector": "port scan syn \u00b7 port 1098 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1098",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 47.23,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_greeting"
]
}
|
|
|
TCP |
5678
|
—
|
Scan de ports
port scan syn · port 5678 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5678
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5678,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0b4791d2069d1e7ab6a7692144d57a81a9f7ca01",
"event_fingerprint": "cbca187ced453ac22cb5de1378e835698115cd2f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5678,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d9099b0663fdaf25246e17de286b2a3bb6bb770",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 5678
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 5678 \u00b7 (reconnaissance)",
"target_port_label": "5678",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 5678
},
"attack_vector": "port scan syn \u00b7 port 5678 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "5678",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 46.98,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks4_greeting"
]
}
|
|
|
TCP |
8010 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8010 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8010
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jt HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jt HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jt HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "0ed5cb6d3da9e57f894b448bb1838c73891ef642",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.025411202261986,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8010,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a17fce6058b53fc2508844fab5c07a7836a92379",
"event_fingerprint": "f11f09c84b95f84dd8d8e09e2251cc2ab0cf06f4",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dab1e4ef8f70057e2b479b9afbad2622",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8010,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jt",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jt",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "192990b1dc1e9ee652358a0ab934fe3bfb0acdf9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance)",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8010 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jt HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 46.51,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Scan de ports
port scan syn · via SOCKS5:1080 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jv HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jv HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jv HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 194,
"payload_entropy": 5.048758238411372,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "socks5",
"app_proto": "socks5",
"asn": 197170,
"country": "NL",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0da7a94bf9ccbdbdab798c485d30e1d5d58bb469",
"event_fingerprint": "58326ea1b700407bfff5f067507bcf4d2f7016fe",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81ee1295bf3927a4766f0dd04cbcdc21",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c28e16e0fab08a15381292ff7ceef97e270a342",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via SOCKS5:1080 \u00b7 (reconnaissance)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SOCKS5 \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "port scan syn \u00b7 via SOCKS5:1080 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jv HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 45.66,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_emulated"
]
}
|
|
|
TCP |
8100 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8100 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8100
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5ju HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5ju HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5ju HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "cefa97b8f7c563f6a52284023a0be409201e01ff",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.048758238411372,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8100,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c2869e438b06e8bcf23619c4163936e78b527ea2",
"event_fingerprint": "a6f7266773573d2288f8baa5cce666f00b38ae9e",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "04a464cd69a3e6764ef62dcb79bdc2fa",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8100,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5ju",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5ju",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99daf3b266977af92fee1ef150d54b76b6e8cde6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1",
"port": 8100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8100 \u00b7 (reconnaissance)",
"target_port_label": "8100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8100,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1",
"port": 8100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8100 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ju HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 45.28,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8014 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8014 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8014
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k2 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k2 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k2 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "cec77d70a82fb01d1675a57ffb0b5fddd13875b4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.030666614677727,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8014,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0773ff2b7407426acf43732397c2d7c2e02854b7",
"event_fingerprint": "3e04bbf54d5600c38684028c7d7885ff264f56a8",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "94b1a1a9824401feb891cae798194bc8",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8014,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k2",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k2",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ecd6a7e53fabb377fb2f9e60ef34c6fd1b52b5c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance)",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8014,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8014"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 45.05,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8042 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jx HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jx HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jx HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "e6894fc261c62bf4f974b2e33296af25457ea14f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369292,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8042,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0a6013355da4fe39bffdfd1fb2b7bf6657099f92",
"event_fingerprint": "25d230227c30d7e6c2db146b733ad6223380885a",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2d767009b7fb344910c5abc9e21c373",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jx",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jx",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1133d8ae3db85dc7a98fe4fdb03bd07002a24e46",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8042 \u00b7 (reconnaissance)",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8042 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 44.52,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8181 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8181 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8181
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5ka HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5ka HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5ka HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "11ca14fc7e8a87d045a64f69b2be2d4544becc25",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.021520029570421,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8181,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b364c7ae549e5871569319d8a2eb3101c6b311a6",
"event_fingerprint": "8545886377df84148550aec7d54fb6d52f7c8a0a",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "059b186a45438c8288c63d34060c0ecc",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8181,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5ka",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5ka",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ebf5d6f5c6162c699a62db57437f64dc5bd3773",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1",
"port": 8181,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8181 \u00b7 (reconnaissance)",
"target_port_label": "8181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8181,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1",
"port": 8181,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8181 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5ka HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 44.28,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jz HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jz HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jz HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "6e732050ae4a09a227cf3fdff2dc6f2b51348310",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.048758238411372,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9002,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f645e68bfb7d63db8afa5272135a6b4da51fbce4",
"event_fingerprint": "0f5c2b462bda58ebc38767729c8fd226ddf2948a",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f96450ee5b81430f2846a481ba5343bb",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jz",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jz",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad01c786c537f70a6518036543c0727b8f5a1e39",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 44.16,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
10808 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:10808 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10808
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5kc HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5kc HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5kc HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "6bd23fe11a8f9b5026947792f2404deabf3088c9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.016146541365653,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 10808,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e64fd1ef0f9f247997bd7304f00335759b8e6937",
"event_fingerprint": "6562cf0c9347d96f440873130f9e0fb0e923405a",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b7f035c2765d96b7dc1cc88e6eafe83",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 10808,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5kc",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5kc",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79d0662cf934305667e0ab9cb157529537388aae",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1",
"port": 10808,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:10808 \u00b7 (reconnaissance)",
"target_port_label": "10808 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10808,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1",
"port": 10808,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10808 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kc HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "10808 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10808"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 43.81,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8013 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8013 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8013
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k4 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k4 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k4 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "be8de72c2b5f7c3f65447523b048dd04f1546ab3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369291,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8013,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "41bb1e3703800c3d012a55f0979cbdbb93a56a83",
"event_fingerprint": "015a0b9ebca5c823eac4e27b80ada77f51b6e52d",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6e87633f0e69dddfcc6c5265d29437dc",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8013,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k4",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k4",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a92802489b656f889142d1a32481f716cac407b1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1",
"port": 8013,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8013 \u00b7 (reconnaissance)",
"target_port_label": "8013 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8013,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1",
"port": 8013,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8013 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8013 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8013"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 43.54,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
5678 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5678 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5678
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jy HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jy HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5jy HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "e496ee8df64dd7e203599fbf96e1932d88d5cd63",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369292,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5678,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "09cc3e2527e514b156b91e106999cbb263217d65",
"event_fingerprint": "f1cfe6bdb3d72f9a9981f2e64d9c65054482097b",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "428f16dc1c9d7de918834b3ed3a86116",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 5678,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jy",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5jy",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f9a634898240162fa0de91caba10fc6ed1a80d8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:5678 \u00b7 (reconnaissance)",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5678 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5jy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 43.29,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8091 · COUCHBASE
|
couchbase
|
Scan de ports
port scan syn · via COUCHBASE:8091 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
COUCHBASE
WAF
—
Recommandation
Surveiller
Tags
couchbase_emulated
couchbase_payload
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8091
Chemin / cible
—
Service
COUCHBASE
Payload
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5kb HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5kb HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5kb HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420636f7563686261736520726561647920706f72743d383039310d0a",
"emulator_response_len": 40,
"bytes_in": 194,
"payload_entropy": 5.0306666146777275,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "couchbase",
"app_proto": "couchbase",
"asn": 197170,
"country": "NL",
"dst_port": 8091,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fdb8d987f6ddc937c2d39ac4dd549460d06a85ac",
"event_fingerprint": "a032868a84f756125902e980581e4d9d67e60d5a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "couchbase",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d2c8a8c9716a83b0a0a40d649ed5b655",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8091,
"service": "couchbase",
"service_name": "couchbase",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "402a41dba1fc5da4fe0cf175b64a5d02cd56ab03",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 8091,
"service": "couchbase",
"service_label_fr": "COUCHBASE"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
"target_port_label": "8091 \u00b7 COUCHBASE",
"emulator_service": "couchbase",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via COUCHBASE \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "couchbase",
"service_label_fr": "COUCHBASE",
"dst_port": 8091,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchbase",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 8091,
"service": "couchbase",
"service_label_fr": "COUCHBASE"
},
"attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5kb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8091 \u00b7 COUCHBASE",
"emulator_service": "couchbase",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchbase",
"service_banner": "honeypot-couchbase",
"service_os": "linux",
"dst_port": "8091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 43.17,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchbase_emulated",
"couchbase_payload",
"net_flood"
]
}
|
|
|
TCP |
8018 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8018 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8018
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k8 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k8 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k8 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "50f664624a6748047f9b7ac0daae9fd183ab1679",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369291,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8018,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "be1ed8e0e3a4f722a84681f14df1fad040c1f9e8",
"event_fingerprint": "f289400ff1fbe82c0ec4cde72b3da24464e7974b",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "13c9d0f74f5e3d6aefd8aa56d45ba79e",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8018,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k8",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k8",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85e27401e007f2a2d3f2a9e9a06d5088a845a823",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1",
"port": 8018,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8018 \u00b7 (reconnaissance)",
"target_port_label": "8018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8018,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1",
"port": 8018,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8018 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8018"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 42.63,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9088 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9088
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k6 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k6 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k6 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "606610fc50954f47802f5eb5d0e8d06fa57313c4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.0448670657198065,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9088,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d2c98bf08d63f9dc855ef5346670dec60edda630",
"event_fingerprint": "8b3555edde681f9dde76d36d69b1a25aa8eaa8c7",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f8b7069e8cb4d55de1aa1001931cb07a",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9088,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k6",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k6",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1065f6abf572e3c0cf2405f594995d197f4bd353",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1",
"port": 9088,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance)",
"target_port_label": "9088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1",
"port": 9088,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 42.4,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8071 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8071 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8071
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k9 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k9 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k9 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "79112688f3466867922a1f8e7f661beec3b33f83",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.0306666146777275,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8071,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4ce1791327e739cee4dda0df20047dbad8137e11",
"event_fingerprint": "74dfda4caa8b52a7cdffbe2a149f0542155d839f",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e12e50f880ee5eea1c7e1d421c9f1e58",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8071,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k9",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k9",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c92694e7b046032612a48b31a4fdacacb073be4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1",
"port": 8071,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8071 \u00b7 (reconnaissance)",
"target_port_label": "8071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1",
"port": 8071,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8071 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 42.2,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9001 · TOR OR
|
tor-or
|
Scan de ports
port scan syn · via TOR OR:9001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TOR-OR
WAF
—
Recommandation
Surveiller
Tags
net_flood
tor_exit_probe
tor_or_emulated
tor_or_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9001
Chemin / cible
—
Service
TOR OR
Payload
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k1 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k1 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k1 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000000000000000",
"emulator_response_len": 9,
"bytes_in": 194,
"payload_entropy": 5.026260671521679,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "tor-or",
"app_proto": "tor-or",
"asn": 197170,
"country": "NL",
"dst_port": 9001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b52b2c1c7cc6b18e729e195f07cbeb37c54cc0a2",
"event_fingerprint": "925ff45fbd00172fd5637e01f1a2163abef9dac3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tor-or",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25db421c10eb308f369154b1a5342988",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9001,
"service": "tor-or",
"service_name": "tor-or",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6252494dce2f9dc0b9a01d0e4a4bebbfae5c57a1",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 9001,
"service": "tor-or",
"service_label_fr": "TOR OR"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
"target_port_label": "9001 \u00b7 TOR OR",
"emulator_service": "tor-or",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR OR \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tor-or",
"service_label_fr": "TOR OR",
"dst_port": 9001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tor-or",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 9001,
"service": "tor-or",
"service_label_fr": "TOR OR"
},
"attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9001 \u00b7 TOR OR",
"emulator_service": "tor-or",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tor_or",
"service_banner": "honeypot-tor-or",
"service_os": "linux",
"dst_port": "9001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 42.13,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tor_exit_probe",
"tor_or_emulated",
"tor_or_payload"
]
}
|
|
|
TCP |
8009 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8009 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8009
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k0 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k0 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k0 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "5d637eb1693138897f1d1006f94ff9aaf6d30908",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369291,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8009,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ad676131f1f4601dad4baad8b8fe424768c3c7bb",
"event_fingerprint": "e4cb0333348654186fd1401bc77f78e28b3cb18f",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4b3fbaa779291f5f7841e912b6e1aeab",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8009,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k0",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k0",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "618cdd7ee73ae535b35d18cd0d06a00c36d35202",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1",
"port": 8009,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)",
"target_port_label": "8009 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8009,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1",
"port": 8009,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8009 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8009"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 41.94,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9008 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9008 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9008
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k3 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k3 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet5k3 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "2e9536ae01ffcf5e59c28d2433b29e70ffcda7b3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369291,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9008,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "470cef20671c3ccb4567a67d6e762d86019a5189",
"event_fingerprint": "50b4a73ef14ff61f2971d054850bade9b69f0471",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6da59cc1fa24132b9b4b52b9166f95ee",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9008,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k3",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet5k3",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b854f2d27390db8b8d006693a2ca3d6a830cb92",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance)",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (50 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9008,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet5k3 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 133,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 133,
"scan_velocity_ports_per_s": 41.84,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 50,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:81 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443 UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_ua_suspicious
net_flood
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
81
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
User-Agent: Go-http-client/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 105,
"payload_entropy": 4.899221447331217,
"port_category": "well_known",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 81,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c8c83e794ae9741c3ae36b10a467f294aae49ec4",
"event_fingerprint": "f0d6dfd1bd83d6d53ef6fd5c7254ae6e92448bb6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "9c57ea0133d6862def4e777f24e80e7b",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"user_agent": "Go-http-client\/1.1",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"user_agent": "Go-http-client\/1.1",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f43f85c6f6de586530e729c52671686ac51d368c",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1",
"attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (44 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nUser-Agent: Go-http-client\/1.1",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 122,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 122,
"scan_velocity_ports_per_s": 74.15,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 44,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_ua_suspicious",
"net_flood"
]
}
|
|
|
TCP |
8014 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8014 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8014
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d6 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d6 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d6 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "bdb9368bbcb83e13f3ccb877bfc3f215adbe73b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.048758238411371,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8014,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0773ff2b7407426acf43732397c2d7c2e02854b7",
"event_fingerprint": "54e7bd96d7b3ae248b73a8a6b1eea7706c44cef0",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e5c87c10c8b4f40859192aec1fb58ec8",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 8014,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d6",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d6",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef1ce178bb570063a5b2404dba55a70a0b191f9e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance)",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (44 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8014,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1",
"port": 8014,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8014 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d6 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8014 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8014"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 122,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 122,
"scan_velocity_ports_per_s": 73.79,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 44,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
9091 · KAFKA JMX
|
kafka-jmx
|
Scan de ports
port scan syn · via KAFKA JMX:9091 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
KAFKA-JMX
WAF
—
Recommandation
Surveiller
Tags
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9091
Chemin / cible
—
Service
KAFKA JMX
Payload
CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a",
"emulator_response_len": 40,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "kafka-jmx",
"app_proto": "kafka-jmx",
"asn": 197170,
"country": "NL",
"dst_port": 9091,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "049cf3a553be8875f1575a970dab8413d99e7b67",
"event_fingerprint": "780fa14a26bbbdc871d49d5298d6c73b9dc3ecc7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "kafka-jmx",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9091,
"service": "kafka-jmx",
"service_name": "kafka-jmx",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5b25359f4a8dcdcd62d9001802df5be30e4c0f2",
"protocol_details": {
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"port": 9091,
"service": "kafka-jmx",
"service_label_fr": "KAFKA JMX"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via KAFKA JMX:9091 \u00b7 (reconnaissance)",
"target_port_label": "9091 \u00b7 KAFKA JMX",
"emulator_service": "kafka-jmx",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KAFKA JMX \u2014 multi-protocole (44 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kafka-jmx",
"service_label_fr": "KAFKA JMX",
"dst_port": 9091,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-jmx",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"port": 9091,
"service": "kafka-jmx",
"service_label_fr": "KAFKA JMX"
},
"attack_vector": "port scan syn \u00b7 via KAFKA JMX:9091 \u00b7 (reconnaissance)",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "9091 \u00b7 KAFKA JMX",
"emulator_service": "kafka-jmx",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_jmx",
"service_banner": "honeypot-kafka-jmx",
"service_os": "linux",
"dst_port": "9091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 122,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 122,
"scan_velocity_ports_per_s": 73.64,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 44,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood"
]
}
|
|
|
TCP |
9008 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9008 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9008
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d9 HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d9 HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d9 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "b1f3ea0410bc76593f6a0493cb6bba90cee3253b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.034557787369292,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9008,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "470cef20671c3ccb4567a67d6e762d86019a5189",
"event_fingerprint": "45c4656ed84b9d842774d017780fd9b605c02472",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ea5e8526cafc670fc1aecb3638b873d0",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9008,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d9",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4d9",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a77f73ad02e8382374a1b53274d7fae3b2fb2e0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance)",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (44 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9008,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9008 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 122,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 122,
"scan_velocity_ports_per_s": 73.22,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 44,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
4155
|
—
|
Scan de ports
port scan syn · port 4155 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4155
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 4155,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "baa73267c7c239ccd1f82432a2cf1da5e785a70c",
"event_fingerprint": "d25d8c51a2c4e5555846fb0b4b14e55850764aa7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4155,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c5db85d12d67abed476463368152842435f204c",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 4155
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 4155 \u00b7 (reconnaissance)",
"target_port_label": "4155",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (45 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 4155,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 4155
},
"attack_vector": "port scan syn \u00b7 port 4155 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "4155",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 123,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 123,
"scan_velocity_ports_per_s": 73.72,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 45,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks4_greeting"
]
}
|
|
|
TCP |
8899
|
—
|
Scan de ports
port scan syn · port 8899 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8899
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 8899,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9bd0d97f0ee92dd3f2c04f8af96cac57bef61c89",
"event_fingerprint": "f2e7e4a8eed9a4dcc410b36ac57f3f840a8bfe1a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8899,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e4a16b5cd8befb2b998335a96b1e48e014919af",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 8899
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 8899 \u00b7 (reconnaissance)",
"target_port_label": "8899",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 8899,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 8899
},
"attack_vector": "port scan syn \u00b7 port 8899 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "8899",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8899"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 123,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 123,
"scan_velocity_ports_per_s": 73.62,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 46,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks4_greeting"
]
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8042 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_flood
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8042
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8042,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f5ee7bec0491b8ae9d08e77ac67d9edeafced7e6",
"event_fingerprint": "b72f8578f3e23580d838366caa350b72c51146eb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cafdd4cbe7cfd97ea344ee959e9e2e0883853c9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8042 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (46 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8042 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 123,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 123,
"scan_velocity_ports_per_s": 73.42,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 46,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
5678
|
—
|
Scan de ports
port scan syn · port 5678 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5678
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 5678,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5408f28a9a5daa290c2f8e042904063dbd270f34",
"event_fingerprint": "cbca187ced453ac22cb5de1378e835698115cd2f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5678,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad5445b9562b5901cd21180fa4d58662e32ec43e",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 5678
},
"attack_vector": "port scan syn \u00b7 port 5678 \u00b7 (reconnaissance)",
"target_port_label": "5678",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 5678
},
"attack_vector": "port scan syn \u00b7 port 5678 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "5678",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 123,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 123,
"scan_velocity_ports_per_s": 73.33,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 46,
"multi_protocol_sample": [
"bitcoin",
"consul",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi",
"jetdirect"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_greeting"
]
}
|
|
|
TCP |
8091 · COUCHBASE
|
couchbase
|
Scan de ports
port scan syn · via COUCHBASE:8091 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
COUCHBASE
WAF
—
Recommandation
Surveiller
Tags
couchbase_emulated
couchbase_payload
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8091
Chemin / cible
—
Service
COUCHBASE
Payload
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dq HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420636f7563686261736520726561647920706f72743d383039310d0a",
"emulator_response_len": 40,
"bytes_in": 194,
"payload_entropy": 5.048758238411371,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "couchbase",
"app_proto": "couchbase",
"asn": 197170,
"country": "NL",
"dst_port": 8091,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fdb8d987f6ddc937c2d39ac4dd549460d06a85ac",
"event_fingerprint": "a032868a84f756125902e980581e4d9d67e60d5a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "couchbase",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d77144a90c254d925062b8a476bd9cda",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8091,
"service": "couchbase",
"service_name": "couchbase",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2bb1fa34db10296bd6c16dd48c6be2b8693c5be",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 8091,
"service": "couchbase",
"service_label_fr": "COUCHBASE"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
"target_port_label": "8091 \u00b7 COUCHBASE",
"emulator_service": "couchbase",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via COUCHBASE \u2014 multi-protocole (47 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "couchbase",
"service_label_fr": "COUCHBASE",
"dst_port": 8091,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchbase",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"port": 8091,
"service": "couchbase",
"service_label_fr": "COUCHBASE"
},
"attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "8091 \u00b7 COUCHBASE",
"emulator_service": "couchbase",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchbase",
"service_banner": "honeypot-couchbase",
"service_os": "linux",
"dst_port": "8091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 124,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 124,
"scan_velocity_ports_per_s": 73.71,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 47,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchbase_emulated",
"couchbase_payload",
"net_flood"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9002 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_flood
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9002
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4a58b30f0ba89b4f3959d829cee33cf7bacac511",
"event_fingerprint": "9d504e9b903c427a4eeb6e57ddc5aa65974c20eb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fdd8abba3393f7a887fb089692f14cfad472f8be",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (47 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 125,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1085,
1086,
1087,
1088,
1089,
1090,
1091
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 125,
"scan_velocity_ports_per_s": 74.09,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 47,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
1084
|
—
|
Scan de ports
port scan syn · port 1084 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1084
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 1084,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "42c2e13f694fe1b75eb346c7cf5c4b502a421941",
"event_fingerprint": "f2bd0fa00a5b5a4e153dc1106a60ddcbe410ed00",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1084,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d35e3f20e9fb3f6ccb2ce6b4511b476d4ea6313",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1084
},
"attack_vector": "port scan syn \u00b7 port 1084 \u00b7 (reconnaissance)",
"target_port_label": "1084",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (48 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1084,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1084
},
"attack_vector": "port scan syn \u00b7 port 1084 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "1084",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 126,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1084,
1085,
1086,
1087,
1088,
1089,
1090
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 126,
"scan_velocity_ports_per_s": 74.58,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 48,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks5_greeting"
]
}
|
|
|
TCP |
4154
|
—
|
Scan de ports
port scan syn · port 4154 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_flood
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4154
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "TechTies Inc.",
"service": null,
"app_proto": null,
"asn": 197170,
"country": "NL",
"dst_port": 4154,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ff326034a501a03d684acb9a95c3cb1479f1ffd1",
"event_fingerprint": "10f1fe3d277cf7178cce51894fb09a321be4d0ec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6d7f72f6464e12cbf41f58650886486",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4154,
"risk_score": 42
},
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d4c233c5d8986be8fb66b5e8b1852e17ad281bd3",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 4154
},
"evidence_snippet": "\ufffd\"\r\ufffdN",
"attack_vector": "port scan syn \u00b7 port 4154 \u00b7 (reconnaissance)",
"target_port_label": "4154",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (49 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 4154,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
"port": 4154
},
"attack_vector": "port scan syn \u00b7 port 4154 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\"\r\ufffdN",
"target_port_label": "4154",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4154"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 127,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1084,
1085,
1086,
1087,
1088,
1089,
1090
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 127,
"scan_velocity_ports_per_s": 75.08,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 49,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"socks4_greeting"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cy HTTP/1.1
User-Agent
—
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cy HTTP/1.1
Host: check.proxypool.sh
Accept: application/json,*/*
Requête brute (extrait)
GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cy HTTP/1.1 Host: check.proxypool.sh Accept: application/json,*/* Cache-Control: no-cache Pragma: no-cache Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
"http_target_hash": "67d0abea6d632d5d2e8b409820ce0df605851005",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 194,
"payload_entropy": 5.005837263015136,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 9002,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f645e68bfb7d63db8afa5272135a6b4da51fbce4",
"event_fingerprint": "b6bccd1367658fa884a5c8295b4a2cb764393d1a",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "717d140fc088731617a7049aa9eb5ded",
"path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cy",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pc_probe=9fcc4fea20118932-bet4cy",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1",
"request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b53455bc21880a548facd72c5246a6529cb63dda",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (49 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cy HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 127,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1084,
1085,
1086,
1087,
1088,
1089,
1090
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 127,
"scan_velocity_ports_per_s": 74.71,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 49,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8012 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8012 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_flood
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8012
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8012,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "07f9b0995fad6dda5be849594b0009ddf4f3a656",
"event_fingerprint": "e62c56d66f5ce0f9f3a3443c74ead4577080e785",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 8012,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dffe22d05f4adcdd8f7f58609668682f0fd418e4",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8012,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "8012 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (49 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8012,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 8012,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8012 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8012 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8012"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 128,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1084,
1085,
1086,
1087,
1088,
1089,
1090
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 128,
"scan_velocity_ports_per_s": 75.07,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 49,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_flood"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Scan de ports
port scan syn · via HDFS NAMENODE:8020 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197170,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b2c3901b70b17ba99999de6bc6ac03b92a0292d6",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed01446c46d660c46bc58be985f8b2f4aff41a10",
"protocol_details": {
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HDFS NAMENODE:8020 \u00b7 (reconnaissance)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (49 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "port scan syn \u00b7 via HDFS NAMENODE:8020 \u00b7 (reconnaissance)",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 128,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1084,
1085,
1086,
1087,
1088,
1089,
1090
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 128,
"scan_velocity_ports_per_s": 74.92,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 49,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood"
]
}
|
|
|
TCP |
5678 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5678 · (reconnaissance) · → check.proxypool.sh:443
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
CONNECT check.proxypool.sh:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_flood
Cible HTTP
CONNECT
check.proxypool.sh:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5678
Chemin / cible
check.proxypool.sh:443
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
CONNECT check.proxypool.sh:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT check.proxypool.sh:443 HTTP/1.1
Host: check.proxypool.sh:443
Proxy-Connection: close
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.732491723718083,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 5678,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5ca2acd97dd95ae04abb0fa56d230283c4cc3849",
"event_fingerprint": "8b644bb6a143a09a1896df2aba7c9a8bb8ac822d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
"path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
},
"target_context": {
"dst_port": 5678,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"evidence": {
"method": "CONNECT",
"path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
"payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "893a27b9fc3bc158d151402770f120586c1f2f78",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:5678 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (49 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "check.proxypool.sh:443",
"request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5678 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
"evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 128,
"port_scan_ports_sample": [
81,
82,
83,
84,
88,
999,
1080,
1081,
1082,
1084,
1085,
1086,
1087,
1088,
1089,
1090
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 128,
"scan_velocity_ports_per_s": 74.69,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 49,
"multi_protocol_sample": [
"bitcoin",
"consul",
"couchbase",
"discord-webhook",
"hdfs-namenode",
"http",
"https",
"java-rmi"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_flood"
]
}
|