|
|
TCP |
5984 · COUCHDB
|
couchdb
|
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.63
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.63
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
"emulator_response_len": 130,
"bytes_in": 187,
"payload_entropy": 5.352899237213371,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 211680,
"country": "PT",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 34,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cd4aa24d616b8c8c9fdc7b65c18cba1fa792652c",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9c65749e9dc94d23ebceaa91ce86dcd9",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"evidence": {
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7409041a5dd9d6dd504c65ddf6eb010a0c1a65dc",
"protocol_details": {
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Scan vulnérabilités
scanner vuln · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
POST /mcp HTTP/1.1 Host: 62.3.50.33:5984 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, te
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:5984
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:5984 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 274,
"payload_entropy": 5.0411566725925,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 211680,
"country": "PT",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "29954183a5ec19d6f27e18af8642b9068b75a9db",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cb8897498eb09bee0a316d212e8cd6a1",
"path_pattern_hash": "b71c8aad2b015494f15e7bb035951b05"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53e99f0c6507bb596b6abc67408887a364b21285",
"protocol_details": {
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "scanner vuln \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"net_couchdb_probe"
]
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Scan vulnérabilités
scanner vuln · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /sse HTTP/1.1 Host: 62.3.50.33:5984 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, tex
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:5984
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:5984 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 252,
"payload_entropy": 5.018090884539288,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 211680,
"country": "PT",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c7da05f13fa984795787428727684213",
"path_pattern_hash": "b71c8aad2b015494f15e7bb035951b05"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6db0abeac257a813cc0d52ab52b9a463ecb043e1",
"protocol_details": {
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "scanner vuln \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"net_couchdb_probe"
]
}
|
|
|
TCP |
53 · DNS
|
dns
|
modbus probe
modbus probe · via DNS:53 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DNS
WAF
—
Recommandation
Surveiller
Tags
dns_emulated
dns_payload
net_dns_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
53
Chemin / cible
—
Service
DNS
Payload
,�D testipinternet-censusorg
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 33
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0357
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Modbus TCP header
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
,�D testipinternet-censusorg
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "002cfe4480030001000000000000067465737469700f696e7465726e65742d63656e737573036f72670000010001",
"emulator_response_len": 46,
"bytes_in": 46,
"payload_entropy": 3.7729244557748207,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "dns",
"app_proto": "dns",
"asn": 211680,
"country": "PT",
"dst_port": 53,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b8c4aaf6dc0dcca2d5434fbaf863fbcc49abe4fe",
"event_fingerprint": "a8ecfe27665a94483df3963a81bc8aaa2d3740ad",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0357"
],
"kb_rule_ids": [
"pat-0357"
],
"matched_patterns": [
"pat-0357",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Modbus TCP header",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0357",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "dns",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f7d38d123d9a0db26cec82faa713cc50",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 53,
"service": "dns",
"service_name": "dns",
"risk_score": 33
},
"payload_preview": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"request_sample": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"payload_snippet": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"evidence": {
"request_sample": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"payload_snippet": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cda11abcef38f133ddf49fae60d4e073f17fd25",
"protocol_details": {
"payload_preview": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"evidence_snippet": ",\ufffdDtestipinternet-censusorg",
"attack_vector": "modbus probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "dns",
"service_label_fr": "DNS",
"dst_port": 53,
"protocol_emulated": true,
"tags_summary": [
"pat-0357"
],
"tags_summary_labels_fr": [
"pat-0357"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dns",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000,\ufffdD\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"attack_vector": "modbus probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"evidence_snippet": ",\ufffdDtestipinternet-censusorg",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dns",
"service_banner": "honeypot-dns",
"service_os": "linux",
"dst_port": "53"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"dns_emulated",
"dns_payload",
"net_dns_probe"
]
}
|
|
|
TCP |
53 · DNS
|
dns
|
dns probe
dns probe · via DNS:53 · (sonde / probe)
|
Élevée
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DNS
WAF
—
Recommandation
Surveiller
Tags
dns_emulated
dns_payload
net_dns_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
53
Chemin / cible
—
Service
DNS
Payload
�� VERSIONBIND
Pourquoi cette classification : Type « dns_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�� VERSIONBIND
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001ebaa3800300010000000000000756455253494f4e0442494e440000100003",
"emulator_response_len": 32,
"bytes_in": 32,
"payload_entropy": 3.4681390622295662,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "dns",
"app_proto": "dns",
"asn": 211680,
"country": "PT",
"dst_port": 53,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b8c4aaf6dc0dcca2d5434fbaf863fbcc49abe4fe",
"event_fingerprint": "a8ecfe27665a94483df3963a81bc8aaa2d3740ad",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 44
},
"service_name": "dns",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "275fae54a7b235f487f390ae2fccf609",
"path_pattern_hash": "1ff272bdca0ffa92c866625cbd3295f6"
},
"target_context": {
"dst_port": 53,
"service": "dns",
"service_name": "dns",
"risk_score": 44
},
"payload_preview": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"request_sample": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"payload_snippet": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"evidence": {
"request_sample": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"payload_snippet": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"classification_reason": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00d4bdc81748d1314ccf1e19f431d118b37de93a",
"protocol_details": {
"payload_preview": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"evidence_snippet": "\ufffd\ufffdVERSIONBIND",
"attack_vector": "dns probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "dns",
"service_label_fr": "DNS",
"dst_port": 53,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dns",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u001e\ufffd\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"attack_vector": "dns probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdVERSIONBIND",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dns",
"service_banner": "honeypot-dns",
"service_os": "linux",
"dst_port": "53"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"dns_emulated",
"dns_payload",
"net_dns_probe"
]
}
|
|
|
TCP |
53 · DNS
|
dns
|
modbus probe
modbus probe · via DNS:53 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DNS
WAF
—
Recommandation
Surveiller
Tags
dns_emulated
dns_payload
net_dns_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
53
Chemin / cible
—
Service
DNS
Payload
,�C testipinternet-censusorg
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 33
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0357
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Modbus TCP header
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
,�C testipinternet-censusorg
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "002cce4380030001000000000000067465737469700f696e7465726e65742d63656e737573036f72670000010001",
"emulator_response_len": 46,
"bytes_in": 46,
"payload_entropy": 3.7729244557748207,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "dns",
"app_proto": "dns",
"asn": 211680,
"country": "PT",
"dst_port": 53,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b8c4aaf6dc0dcca2d5434fbaf863fbcc49abe4fe",
"event_fingerprint": "a8ecfe27665a94483df3963a81bc8aaa2d3740ad",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0357"
],
"kb_rule_ids": [
"pat-0357"
],
"matched_patterns": [
"pat-0357",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Modbus TCP header",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0357",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "dns",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b0817bf664cf3771a7cb723480b403d",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 53,
"service": "dns",
"service_name": "dns",
"risk_score": 33
},
"payload_preview": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"request_sample": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"payload_snippet": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"evidence": {
"request_sample": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"payload_snippet": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e71f6c8ff2f9af21b9bb567e3230c5a03f3d259f",
"protocol_details": {
"payload_preview": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"evidence_snippet": ",\ufffdCtestipinternet-censusorg",
"attack_vector": "modbus probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "dns",
"service_label_fr": "DNS",
"dst_port": 53,
"protocol_emulated": true,
"tags_summary": [
"pat-0357"
],
"tags_summary_labels_fr": [
"pat-0357"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dns",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000,\ufffdC\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006testip\u000finternet-census\u0003org\u0000\u0000\u0001\u0000\u0001",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"attack_vector": "modbus probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"evidence_snippet": ",\ufffdCtestipinternet-censusorg",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dns",
"service_banner": "honeypot-dns",
"service_os": "linux",
"dst_port": "53"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"dns_emulated",
"dns_payload",
"net_dns_probe"
]
}
|
|
|
TCP |
53 · DNS
|
dns
|
dns probe
dns probe · via DNS:53 · (sonde / probe)
|
Élevée
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DNS
WAF
—
Recommandation
Surveiller
Tags
dns_emulated
dns_payload
net_dns_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
53
Chemin / cible
—
Service
DNS
Payload
:� VERSIONBIND
Pourquoi cette classification : Type « dns_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
:� VERSIONBIND
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001e3a95800300010000000000000756455253494f4e0442494e440000100003",
"emulator_response_len": 32,
"bytes_in": 32,
"payload_entropy": 3.4681390622295662,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "dns",
"app_proto": "dns",
"asn": 211680,
"country": "PT",
"dst_port": 53,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b8c4aaf6dc0dcca2d5434fbaf863fbcc49abe4fe",
"event_fingerprint": "a8ecfe27665a94483df3963a81bc8aaa2d3740ad",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 44
},
"service_name": "dns",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a557ea54227dbc966d46cf1844313f51",
"path_pattern_hash": "1ff272bdca0ffa92c866625cbd3295f6"
},
"target_context": {
"dst_port": 53,
"service": "dns",
"service_name": "dns",
"risk_score": 44
},
"payload_preview": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"request_sample": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"payload_snippet": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"evidence": {
"request_sample": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"payload_snippet": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"classification_reason": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6cd460d577b379c39be380b3c892601414fe021a",
"protocol_details": {
"payload_preview": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"evidence_snippet": ":\ufffdVERSIONBIND",
"attack_vector": "dns probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab dns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "dns",
"service_label_fr": "DNS",
"dst_port": 53,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dns",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u001e:\ufffd\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007VERSION\u0004BIND\u0000\u0000\u0010\u0000\u0003",
"port": 53,
"service": "dns",
"service_label_fr": "DNS"
},
"attack_vector": "dns probe \u00b7 via DNS:53 \u00b7 (sonde \/ probe)",
"evidence_snippet": ":\ufffdVERSIONBIND",
"target_port_label": "53 \u00b7 DNS",
"emulator_service": "dns",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dns",
"service_banner": "honeypot-dns",
"service_os": "linux",
"dst_port": "53"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"dns_emulated",
"dns_payload",
"net_dns_probe"
]
}
|
|
|
TCP |
8010 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8010 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8010
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:8010
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:8010 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "90199038884baa59455d3404a4ba05d942a7b0fe",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 4.989340438119301,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 8010,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f6e7b955d023c7c714fa0a19da556fd76430b972",
"event_fingerprint": "7d469f99af4bbebca5fa922d5b939a3a9ff1dbc9",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "f18e8b46ac58848bd7f0ebfa2eb1d33b",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 8010,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de5bbffbc89f1428f298250579218ea5e4297257",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via HTTP:8010 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8010 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8010"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
8010 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8010 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950383:rce-14
950470:nosqli-3
http_jwt_body
net_web_probe
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8010
Chemin / cible
/mcp
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
rce-14
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:8010
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:8010 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "90199038884baa59455d3404a4ba05d942a7b0fe",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 515,
"payload_entropy": 5.1157362383412694,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 8010,
"risk_waf": 60,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6db5ef7bba02f8ea87bd2370c2df7137d2c4d149",
"event_fingerprint": "9d0f2e9b0eeb1c97604675d95605a0f3acdf4816",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "5e799ce504d116ce8828f42939868b7f",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 8010,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950383:rce-14",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-14",
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950383:rce-14",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-14",
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20ecd78a479a28ee7425e4f169035b29362040b4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:8010 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8010 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8010"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950383:rce-14",
"950470:nosqli-3",
"http_jwt_body",
"net_web_probe"
]
}
|
|
|
TCP |
8010 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8010 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0…
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8010
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 44 · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8010
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8010 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f",
"http_host_hash": "90199038884baa59455d3404a4ba05d942a7b0fe",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 176,
"payload_entropy": 5.307244835743901,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 8010,
"risk_waf": 44,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c939d428cf0a3d91f30d62ed797e2d7dcb868c5f",
"event_fingerprint": "a0924166f38055d058946090b56ffbe37e0dc198",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e",
"payload_hash": "e0a27b4282f2381bfb0ebcae3aef43dd",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 8010,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f781fdae406cfc74af9a97578aed7662be9143a1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8010 \u00b7 (sonde \/ probe)",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8010 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8010\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8010"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
]
}
|
|
|
TCP |
8010 · HTTP ALT 8010
|
http-alt-8010
|
http-alt-8010
http-alt-8010 · via HTTP ALT 8010:8010 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8010
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8010
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-8010 » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http-alt-8010",
"app_proto": "http-alt-8010",
"asn": 211680,
"country": "PT",
"dst_port": 8010,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e45d04116002e45e0727e0bc764d20f784c49b73",
"event_fingerprint": "3c8bec9ff6243353dd9f4241f81b225f3feb7ea2",
"classification_reason": "Type \u00ab http-alt-8010 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "http-alt-8010",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "7b08621554e2742ecb4fc96115d86887"
},
"target_context": {
"dst_port": 8010,
"service": "http-alt-8010",
"service_name": "http-alt-8010",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b262f55aafc252645cb4a64ee1a8b0b7b8f0d0bf",
"protocol_details": {
"port": 8010,
"service": "http-alt-8010",
"service_label_fr": "HTTP ALT 8010"
},
"attack_vector": "http-alt-8010 \u00b7 via HTTP ALT 8010:8010 \u00b7 (sonde \/ probe)",
"target_port_label": "8010 \u00b7 HTTP ALT 8010",
"emulator_service": "http-alt-8010",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8010 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-8010 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "http-alt-8010",
"service_label_fr": "HTTP ALT 8010",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8010",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8010,
"service": "http-alt-8010",
"service_label_fr": "HTTP ALT 8010"
},
"attack_vector": "http-alt-8010 \u00b7 via HTTP ALT 8010:8010 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8010 \u00b7 HTTP ALT 8010",
"emulator_service": "http-alt-8010",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8010",
"service_banner": "honeypot-http-alt-8010",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
515 · LPD
|
lpd
|
Sonde PostgreSQL
postgres probe · via LPD:515 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
LPD
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
515
Chemin / cible
—
Service
LPD
Payload
� �ȥ�Kv��ZW�); j�|ێ��XbE���� ��c�u���b�/��<��8�ԙ*�H� �$� &̨̩�/�0�+�,�� �� � � / 5� L
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ȥ�Kv��ZW�); j�|ێ��XbE���� ��c�u���b�/��<��8�ԙ*�H� �$� &̨̩�/�0�+�,�� ��
� � / 5�
L
Requête brute (extrait)
� �ȥ�Kv��ZW�); j�|ێ��XbE���� ��c�u���b�/��<��8�ԙ*�H� �$� &̨̩�/�0�+�,�� �� � � / 5� L � � http/1.1 + 3�����[S�炣��5C�j�o�Wo;VlJ�5l&} ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206c706420726561647920706f72743d3531350d0a",
"emulator_response_len": 33,
"bytes_in": 1476,
"payload_entropy": 7.766479012580848,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "lpd",
"app_proto": "lpd",
"asn": 211680,
"country": "PT",
"dst_port": 515,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1ea374ae7c58fbf8227cbc13693ca424aab98d24",
"event_fingerprint": "a19fd83a9856f1c122b80b6c10e618dae1ce3474",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "lpd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bc41bf7dd9c486e4ca6e08df824485b5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 515,
"service": "lpd",
"service_name": "lpd",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0225\ufffdKv\ufffd\ufffdZ\u0001W\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXb\u0018E\u000f\u0005\ufffd\ufffd\u0014\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\u0004\u0004\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\u0002\u001d\ufffd$\ufffd\u0017\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0225\ufffdKv\ufffd\ufffdZ\u0001W\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXb\u0018E\u000f\u0005\ufffd\ufffd\u0014\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\u0004\u0004\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\u0002\u001d\ufffd$\ufffd\u0017\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd[S\ufffd\u70a3\ufffd\ufffd5C\ufffdj\ufffdo\ufffdWo;VlJ\ufffd\u00135l&}\u001c\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0225\ufffdKv\ufffd\ufffdZ\u0001W\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXb\u0018E\u000f\u0005\ufffd\ufffd\u0014\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\u0004\u0004\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\u0002\u001d\ufffd$\ufffd\u0017\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ebdd5f75f53a9cb91a6440c661dae380b50e7d6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0225\ufffdKv\ufffd\ufffdZ\u0001W\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXb\u0018E\u000f\u0005\ufffd\ufffd\u0014\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\u0004\u0004\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\u0002\u001d\ufffd$\ufffd\u0017\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"evidence_snippet": "\ufffd\ufffd\u0225\ufffdKv\ufffd\ufffdZW\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXbE\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\ufffd$\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
"attack_vector": "postgres probe \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "lpd",
"service_label_fr": "LPD",
"dst_port": 515,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-lpd",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0225\ufffdKv\ufffd\ufffdZ\u0001W\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXb\u0018E\u000f\u0005\ufffd\ufffd\u0014\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\u0004\u0004\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\u0002\u001d\ufffd$\ufffd\u0017\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"attack_vector": "postgres probe \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u0225\ufffdKv\ufffd\ufffdZW\ufffd);\tj\ufffd|\u06ce\ufffd\ufffdXbE\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdc\ufffdu\ufffd\ufffd\ufffdb\ufffd\/\ufffd\ufffd<\ufffd\ufffd8\ufffd\u0519*\ufffdH\ufffd\ufffd$\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "lpd",
"service_banner": "honeypot-lpd",
"service_os": "linux",
"dst_port": "515"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "45.156.128.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
515 · LPD
|
lpd
|
Sonde PostgreSQL
postgres probe · via LPD:515 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 02f32644e1b0655c
Émulateur
LPD
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
515
Chemin / cible
—
Service
LPD
Payload
� ���?9���(;�D��e��x� E�t ��f� B���� �� / 5� �$�#� � ��(�'��� = < 5 / �� �+�/ � .
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���?9���(;�D��e��x� E�t
��f� B���� ��
/ 5�
�$�#�
� ��(�'��� = < 5 /
�� �+�/ � .
Requête brute (extrait)
� ���?9���(;�D��e��x� E�t ��f� B���� �� / 5� �$�#� � ��(�'��� = < 5 / �� �+�/ � . �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206c706420726561647920706f72743d3531350d0a",
"emulator_response_len": 33,
"bytes_in": 162,
"payload_entropy": 4.751090229398966,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "lpd",
"app_proto": "lpd",
"asn": 211680,
"country": "PT",
"dst_port": 515,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1ea374ae7c58fbf8227cbc13693ca424aab98d24",
"event_fingerprint": "a19fd83a9856f1c122b80b6c10e618dae1ce3474",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "lpd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bada404b2a41212e09787197229a9e3e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
"ja4": "a3533e7527e047470b74402d4bc8a6dd",
"tls_version": "0x0303",
"tls_cipher_count": 33,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "02f32644e1b0655c19aaa3a2d6778b1e",
"tls_ja3": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3533e7527e047470b74402d4bc8a6dd",
"tls_ja4": "t13d0133_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 33,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 515,
"service": "lpd",
"service_name": "lpd",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffd\be\ufffd\u0014\ufffdx\ufffd\tE\ufffdt\u0001\n\u001d\ufffd\u0013\ufffdf\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffd\be\ufffd\u0014\ufffdx\ufffd\tE\ufffdt\u0001\n\u001d\ufffd\u0013\ufffdf\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\n\u0000\b\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffd\be\ufffd\u0014\ufffdx\ufffd\tE\ufffdt\u0001\n\u001d\ufffd\u0013\ufffdf\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cf00d154322615eceb290c790c528e3f8e7fd78",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffd\be\ufffd\u0014\ufffdx\ufffd\tE\ufffdt\u0001\n\u001d\ufffd\u0013\ufffdf\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
"tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffde\ufffd\ufffdx\ufffd\tE\ufffdt\n\ufffd\ufffdf\ufffdB\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
"attack_vector": "postgres probe \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "lpd",
"service_label_fr": "LPD",
"dst_port": 515,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-lpd",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffd\be\ufffd\u0014\ufffdx\ufffd\tE\ufffdt\u0001\n\u001d\ufffd\u0013\ufffdf\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
"tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"attack_vector": "postgres probe \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd?9\ufffd\ufffd\ufffd(;\ufffdD\ufffd\ufffde\ufffd\ufffdx\ufffd\tE\ufffdt\n\ufffd\ufffdf\ufffdB\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "lpd",
"service_banner": "honeypot-lpd",
"service_os": "linux",
"dst_port": "515"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "45.156.128.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
515 · LPD
|
lpd
|
lpd
lpd · via LPD:515 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
LPD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
515
Chemin / cible
—
Pourquoi cette classification : Type « lpd » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206c706420726561647920706f72743d3531350d0a",
"emulator_response_len": 33,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "lpd",
"app_proto": "lpd",
"asn": 211680,
"country": "PT",
"dst_port": 515,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4fe2a5980ed711910f8d59416d28e6ba0238e0fc",
"event_fingerprint": "a19fd83a9856f1c122b80b6c10e618dae1ce3474",
"classification_reason": "Type \u00ab lpd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "lpd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ebe4a1b422624ccc71016f86c2a12169"
},
"target_context": {
"dst_port": 515,
"service": "lpd",
"service_name": "lpd",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd4aaa543fe38cb31fae51d7a36c6f564a317cd7",
"protocol_details": {
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"attack_vector": "lpd \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lpd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab lpd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "lpd",
"service_label_fr": "LPD",
"dst_port": 515,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-lpd",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"attack_vector": "lpd \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "lpd",
"service_banner": "honeypot-lpd",
"service_os": "linux",
"dst_port": "515"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "45.156.128.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
515 · LPD
|
lpd
|
lpd
lpd · via LPD:515 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
LPD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
515
Chemin / cible
—
Pourquoi cette classification : Type « lpd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206c706420726561647920706f72743d3531350d0a",
"emulator_response_len": 33,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Sistemas Informaticos, S.A.",
"service": "lpd",
"app_proto": "lpd",
"asn": 211680,
"country": "PT",
"dst_port": 515,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4fe2a5980ed711910f8d59416d28e6ba0238e0fc",
"event_fingerprint": "a19fd83a9856f1c122b80b6c10e618dae1ce3474",
"classification_reason": "Type \u00ab lpd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "lpd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ebe4a1b422624ccc71016f86c2a12169"
},
"target_context": {
"dst_port": 515,
"service": "lpd",
"service_name": "lpd",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd4aaa543fe38cb31fae51d7a36c6f564a317cd7",
"protocol_details": {
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"attack_vector": "lpd \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lpd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab lpd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "lpd",
"service_label_fr": "LPD",
"dst_port": 515,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-lpd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 515,
"service": "lpd",
"service_label_fr": "LPD"
},
"attack_vector": "lpd \u00b7 via LPD:515 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "515 \u00b7 LPD",
"emulator_service": "lpd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "lpd",
"service_banner": "honeypot-lpd",
"service_os": "linux",
"dst_port": "515"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
2761 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:2761 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
2761
Chemin / cible
/mcp
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:2761
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:2761 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "9a46d60555401defdfb3d47fc892c63a4dc6e7c9",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 274,
"payload_entropy": 5.030737866124349,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 2761,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "8b714afd23eddc03abee3c8987dff0bfc40d163d",
"event_fingerprint": "7243df231af1006af0305a26c3a7e5265b29cf19",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "b1e5226fea8ee306e4729bcf94c6a2df",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 2761,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22649b38a77f84f5017908aa70b525e8f7f5cc34",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 2761,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:2761 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "2761 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2761,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 2761,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:2761 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "2761 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2761"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2761"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
2761 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:2761 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2761
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:2761
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:2761 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "9a46d60555401defdfb3d47fc892c63a4dc6e7c9",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 5.002217868666272,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 2761,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "8b714afd23eddc03abee3c8987dff0bfc40d163d",
"event_fingerprint": "ae19bdb3d74bc78b6371bf5b0f939844fda01cfe",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "f440dd634eb259188fe9f53bfb852371",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 2761,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9117b4033798f39dfc6446504e261935433314f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 2761,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via HTTP:2761 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "2761 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2761,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 2761,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:2761 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:2761\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "2761 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2761"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2761"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
2761
|
—
|
Sonde port
Sonde port · port 2761 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2761
Chemin / cible
—
Payload
ANY-SCP FINDSCU 1.2.840.10008.3.1.1.1 a � 0 1.2.840.10008.5.1
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0577
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
ANY-SCP FINDSCU 1.2.840.10008.3.1.1.1 a � 0 1.2.840.10008.5.1
Requête brute (extrait)
ANY-SCP FINDSCU 1.2.840.10008.3.1.1.1 a � 0 1.2.840.10008.5.1.4.31@ 1.2.840.10008.1.2.1@ 1.2.840.10008.1.2.2@ 1.2.840.10008.1.2P :Q @ R 1.2.276.0.7230010.3.0.3.6.0U OFFIS_DCM
Meta JSON brut
{
"bytes_in": 262,
"payload_entropy": 3.9772768900041515,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": null,
"app_proto": null,
"asn": 211680,
"country": "PT",
"dst_port": 2761,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1c8876b03c5b363fc29a85c2a80c9314a2dfbb3a",
"event_fingerprint": "e0a89577273a582a7656204a22ee577d37aa5c5d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0577"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "603977db4ee11b62780b608ac4d3842a",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2761,
"risk_score": 44
},
"payload_preview": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1",
"request_sample": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1.4.31@\u0000\u0000\u00131.2.840.10008.1.2.1@\u0000\u0000\u00131.2.840.10008.1.2.2@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001b1.2.276.0.7230010.3.0.3.6.0U\u0000\u0000\u000fOFFIS_DCM",
"payload_snippet": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1",
"evidence": {
"request_sample": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1.4.31@\u0000\u0000\u00131.2.840.10008.1.2.1@\u0000\u0000\u00131.2.840.10008.1.2.2@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001b1.2.276.0.7230010.3.0.3.6.0U\u0000\u0000\u000fOFFIS_DCM",
"payload_snippet": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5d620f3653802b3b71817743fcf4429a44aa5ef",
"protocol_details": {
"payload_preview": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1",
"port": 2761
},
"evidence_snippet": "ANY-SCP FINDSCU 1.2.840.10008.3.1.1.1 a\ufffd01.2.840.10008.5.1",
"attack_vector": "Sonde port \u00b7 port 2761 \u00b7 (sonde \/ probe)",
"target_port_label": "2761",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2761,
"protocol_emulated": null,
"tags_summary": [
"pat-0577"
],
"tags_summary_labels_fr": [
"pat-0577"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001\u0000\u0000ANY-SCP FINDSCU \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000a\u0001\u0000\ufffd\u00000\u0000\u0000\u00161.2.840.10008.5.1",
"port": 2761
},
"attack_vector": "Sonde port \u00b7 port 2761 \u00b7 (sonde \/ probe)",
"evidence_snippet": "ANY-SCP FINDSCU 1.2.840.10008.3.1.1.1 a\ufffd01.2.840.10008.5.1",
"target_port_label": "2761",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2761"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
2761
|
—
|
Sonde port
Sonde port · port 2761 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2761
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": null,
"app_proto": null,
"asn": 211680,
"country": "PT",
"dst_port": 2761,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1c8876b03c5b363fc29a85c2a80c9314a2dfbb3a",
"event_fingerprint": "e0a89577273a582a7656204a22ee577d37aa5c5d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2761,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "369b86fef6b8c876130d83fbc4d2838c595842ba",
"protocol_details": {
"port": 2761
},
"attack_vector": "Sonde port \u00b7 port 2761 \u00b7 (sonde \/ probe)",
"target_port_label": "2761",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2761,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 2761
},
"attack_vector": "Sonde port \u00b7 port 2761 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2761",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2761"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
21025 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:21025 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
21025
Chemin / cible
/mcp
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:21025
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, t
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:21025 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Cont
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "0ed1ba4029dc6bceccf971c3ee0fd6e028c48192",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 275,
"payload_entropy": 5.0240036506312515,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 21025,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "07b4a54afe59b2c9cc933c1a080c095b687ff654",
"event_fingerprint": "c69e808774463bac81f78e25d3037a7ad283296f",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "d07b764e0c0433470cd47160c37bfcc5",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 21025,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nCont",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nCont",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df956862330776eb0b736b58995f5b43c6cf1fc1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 21025,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
"attack_vector": "scanner vuln \u00b7 via HTTP:21025 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "21025 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21025,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 21025,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:21025 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
"target_port_label": "21025 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21025"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:21025"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
21025 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:21025 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
21025
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:21025
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:21025 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "0ed1ba4029dc6bceccf971c3ee0fd6e028c48192",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 253,
"payload_entropy": 4.995975243397553,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 21025,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "07b4a54afe59b2c9cc933c1a080c095b687ff654",
"event_fingerprint": "f1c82122eb3fdbcb2e84f7725fd707c79793735b",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "f59b425e1003ad624989a42e3987fb71",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 21025,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "178008dffd5dd3d07365c6d74824e62dc459f3bb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 21025,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:21025 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "21025 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21025,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 21025,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:21025 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "21025 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21025"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:21025"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
21025 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:21025 · (sonde / probe) · → /favicon.ico
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /favicon.ico UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0…
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
21025
Chemin / cible
/favicon.ico
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 50 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36
Règles WAF
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:21025
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:21025 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f",
"http_host_hash": "0ed1ba4029dc6bceccf971c3ee0fd6e028c48192",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 188,
"payload_entropy": 5.30997921027001,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 21025,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "07b4a54afe59b2c9cc933c1a080c095b687ff654",
"event_fingerprint": "ad688b17e4c45133a901b5817717f085cbf60c0d",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e",
"payload_hash": "fe14e954956a3251260d41d1ef7e6759",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 21025,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "67858bd37a096f60278fd794fb44f6bba46c1175",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 21025,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21025 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "21025 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21025,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 21025,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:21025 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21025\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
"target_port_label": "21025 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21025"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:21025"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
21025
|
—
|
Sonde port
Sonde port · port 21025 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
21025
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": null,
"app_proto": null,
"asn": 211680,
"country": "PT",
"dst_port": 21025,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "7ddb16ad6fcb5b512c25e0a2865f6f3a757f1303",
"event_fingerprint": "08d63b0af7dab09cdc0a9297df02df25702b96a4",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 21025,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bb314ef8223734201697fbca89f7fc0d3ca6d3a",
"protocol_details": {
"port": 21025
},
"attack_vector": "Sonde port \u00b7 port 21025 \u00b7 (sonde \/ probe)",
"target_port_label": "21025",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 21025,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 21025
},
"attack_vector": "Sonde port \u00b7 port 21025 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "21025",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "21025"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
net_web_probe
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8080
Chemin / cible
/mcp
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:8080
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:8080 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 274,
"payload_entropy": 5.023803068570007,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 8080,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "28ffa920a480bd1b540cd5abb003186a4ee07e79",
"event_fingerprint": "73bcae9929add3dd0a3000a75d61a3077661f64c",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "4bbc59eb5e9ff7eb37e9728ac147258f",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed32475cc3d912c31bb5a0ba89387f4bc2cf1a23",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:8080
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:8080 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 4.9912857754037185,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 8080,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "28ffa920a480bd1b540cd5abb003186a4ee07e79",
"event_fingerprint": "83e17d6e214e2152210aa801ca59b83413ba7ded",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "3b8f8d1f1af3da28549f474110a890be",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ee214a6afe1f547f0d83d5da066a4c833af3b3b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
1599 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:1599 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
1599
Chemin / cible
/mcp
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:1599
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:1599 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "65ed77ac168b419ebc4c9d6120159f1ac40b3484",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 274,
"payload_entropy": 5.026558132446515,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 1599,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "dc7b34d5168cdd7c022e32ac6ed803dc0b271c9b",
"event_fingerprint": "e33f9c7a7ba19eb5325757ebcc76339f42390513",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "12b1bff969d53981c4cb3749cb8eb011",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 1599,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3ff8db4afe9b876d063151a67158f03674442a0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 1599,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:1599 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "1599 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1599,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 1599,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:1599 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "1599 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1599"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1599"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
1599 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:1599 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1599
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:1599
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:1599 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "65ed77ac168b419ebc4c9d6120159f1ac40b3484",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 5.005213453992318,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 1599,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "dc7b34d5168cdd7c022e32ac6ed803dc0b271c9b",
"event_fingerprint": "b08af497db478267dac61f11678537cc03daa4ae",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "302d740a66dc20426305d202e95ade35",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 1599,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e837316cbb74dba800a6c395a6b53aec3dc3c632",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 1599,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via HTTP:1599 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "1599 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1599,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 1599,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:1599 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:1599\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "1599 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1599"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1599"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
1599
|
—
|
Sonde port
Sonde port · port 1599 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1599
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": null,
"app_proto": null,
"asn": 211680,
"country": "PT",
"dst_port": 1599,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "de8b148760772a4e440e08aa5217c7d5490c08e2",
"event_fingerprint": "c17e0c9216b5f099b3ce93bba9ffc1fdaf30e039",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 1599,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc83ec751d10174b4086b036f3ad2920908bd717",
"protocol_details": {
"port": 1599
},
"attack_vector": "Sonde port \u00b7 port 1599 \u00b7 (sonde \/ probe)",
"target_port_label": "1599",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1599,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 1599
},
"attack_vector": "Sonde port \u00b7 port 1599 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1599",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1599"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
3310 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:3310 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3310
Chemin / cible
/mcp
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:3310
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:3310 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 274,
"payload_entropy": 5.0064494645475115,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 3310,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "573f70149c452bda5242ba0ed6282664a67ce4fa",
"event_fingerprint": "489f256389611896c8eb416eef0a727b5c48231b",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "82195187fdac5d44cae8394f03cd1eb9",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "285bef1cebdac45a2dee42dbe7dacda861dde2e2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:3310 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:3310 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
3310 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:3310 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3310
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:3310
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:3310 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 4.982952975919155,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 3310,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "573f70149c452bda5242ba0ed6282664a67ce4fa",
"event_fingerprint": "abab9b1ae0b222b1dea309fa68974c7f5e2fcfab",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "dc1f061c3776b1a5cfca353b0f6ca2a7",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d859b6b6a29ce1030d138a1304b2ed3684b87b4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via HTTP:3310 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:3310 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
3310
|
—
|
Sonde port
Sonde port · port 3310 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3310
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": null,
"app_proto": null,
"asn": 211680,
"country": "PT",
"dst_port": 3310,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2cb6c394742bd0192356a1643ceec8cc37256193",
"event_fingerprint": "abadc453fb643677108d8be56d3ad690816c3f18",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3310,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6127bdb5e87f2ed0fb9bec2f830d63735ca2ca9f",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"target_port_label": "3310",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3310",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
3460 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:3460 · (sonde / probe) · → /mcp
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /mcp UA python-httpx/0.28.1
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950383:rce-14
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/mcp
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3460
Chemin / cible
/mcp
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
POST /mcp HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
rce-14
nosqli-3
Payload (extrait)
POST /mcp HTTP/1.1
Host: 62.3.50.33:3460
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, te
Requête brute (extrait)
POST /mcp HTTP/1.1 Host: 62.3.50.33:3460 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate Conte
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "272fe549d85c37df95c5507519761c1dbb83eac3",
"http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 509,
"payload_entropy": 5.148466898118664,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 3460,
"risk_waf": 60,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "148dd42752f5dddaa3af7b9a5c845450f4c678fa",
"event_fingerprint": "840d29c91400308c91dbe24bfb316ff93a691c27",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "1a843c5957ff93391f775e05b5afcff7",
"path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
},
"target_context": {
"dst_port": 3460,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950383:rce-14",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-14",
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"evidence": {
"method": "POST",
"path": "\/mcp",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950383:rce-14",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-14",
"nosqli-3"
],
"request_line": "POST \/mcp HTTP\/1.1",
"request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
"payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95ebe624091e530f023fecccbe8357737716d0ce",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3460,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"attack_vector": "scanner vuln \u00b7 via HTTP:3460 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"target_port_label": "3460 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3460,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/mcp",
"request_line": "POST \/mcp HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3460,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:3460 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
"evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
"target_port_label": "3460 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3460"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3460"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950383:rce-14",
"950470:nosqli-3",
"http_jwt_body"
]
}
|
|
|
TCP |
3460 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:3460 · (sonde / probe) · → /sse
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sse UA python-httpx/0.28.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/sse
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3460
Chemin / cible
/sse
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0596
pat-0439
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /sse HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
nosqli-3
Payload (extrait)
GET /sse HTTP/1.1
Host: 62.3.50.33:3460
Connection: keep-alive
User-Agent: python-httpx/0.28.1
accept: application/json, tex
Requête brute (extrait)
GET /sse HTTP/1.1 Host: 62.3.50.33:3460 Connection: keep-alive User-Agent: python-httpx/0.28.1 accept: application/json, text/event-stream accept-Language: * content-type: application/json sec-Fetch-Mode: cors accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "272fe549d85c37df95c5507519761c1dbb83eac3",
"http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 5.002217868666272,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "http",
"app_proto": "http",
"asn": 211680,
"country": "PT",
"dst_port": 3460,
"risk_waf": 32,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "841ac94a80fc880618d2a5c21822a1f9ae87b2bc",
"event_fingerprint": "f879135ca9dff74be8f99833ccc7b10f53fd9c4a",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 106,
"precision_signals": [
"pat-0596",
"pat-0439"
],
"kb_rule_ids": [
"pat-0596",
"pat-0439"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "37a45c8eb1b7197fddd64bea57314a80",
"path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
},
"target_context": {
"dst_port": 3460,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"evidence": {
"method": "GET",
"path": "\/sse",
"user_agent": "python-httpx\/0.28.1",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sse HTTP\/1.1",
"request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
"payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87de6fa85ba1a297e00d85ff171151e5d3ebbb9e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3460,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"attack_vector": "scanner vuln \u00b7 via HTTP:3460 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"target_port_label": "3460 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3460,
"protocol_emulated": null,
"tags_summary": [
"pat-0596",
"pat-0439"
],
"tags_summary_labels_fr": [
"pat-0596",
"pat-0439"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sse",
"request_line": "GET \/sse HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3460,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:3460 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
"evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:3460\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
"target_port_label": "3460 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3460"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3460"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
3460
|
—
|
Sonde port
Sonde port · port 3460 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3460
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": null,
"app_proto": null,
"asn": 211680,
"country": "PT",
"dst_port": 3460,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2372d03e7fe395cf2e4bbd7a2877c35728c29a8a",
"event_fingerprint": "cf74c78ac826a23840051a464f73823acaa15d40",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3460,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "173468c3520e5abdfefb96b71e8ff4d754004c4c",
"protocol_details": {
"port": 3460
},
"attack_vector": "Sonde port \u00b7 port 3460 \u00b7 (sonde \/ probe)",
"target_port_label": "3460",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3460,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3460
},
"attack_vector": "Sonde port \u00b7 port 3460 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3460",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3460"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
27017 · MONGODB
|
mongodb
|
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 ea217b0edcd93778
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_wire_protocol
net_mongodb_wire_protocol
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
� �拏�"$� {L�����e�;��c��~� �� y�� P@�"1���:��m�~5�@����� � } #
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 80%
Confiance classification
90%
Corrélation +10
Risque capteur
Faible
· 33
Confiance : Confiance 80 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
ET-PROTO-MongoDB-Wire
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �拏�"$� {L�����e�;��c��~�
�� y�� P@�"1���:��m�~5�@����� � }
#
Requête brute (extrait)
� �拏�"$� {L�����e�;��c��~� �� y�� P@�"1���:��m�~5�@����� � } # + - 3 & $ t� �ιd�}�C�я�S�Ʊڦ �C�k�dt
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 215,
"payload_entropy": 5.783089132290328,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 211680,
"country": "PT",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 33,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "280a95715c5eaf3778f9712fc1d744ce21252865",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
"confidence": 0.9,
"classification_confidence": 0.9,
"precision_score": 90,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 80,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9c46df8883d676adaf8ca486f095f9a",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea",
"ja3": "ea217b0edcd93778471552ba0b796f81",
"ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
"tls_version": "0x0303",
"tls_cipher_count": 4,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "ea217b0edcd93778471552ba0b796f81",
"tls_ja3": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
"tls_ja4_hash": "20cfcea4d0b06a5e70878e2ac1bf55f4",
"tls_ja4": "t13d0104_a77009cba1e2_1e298527d56b",
"tls_version": "0x0303",
"tls_cipher_count": 4,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019\uf95b\ufffd\"$\u000e\ufffd\u001f{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\u0006\ufffd y\ufffd\ufffd\u001b\u0018\u001cP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\u001b\ufffd\u0001~5\ufffd@\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019\uf95b\ufffd\"$\u000e\ufffd\u001f{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\u0006\ufffd y\ufffd\ufffd\u001b\u0018\u001cP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\u001b\ufffd\u0001~5\ufffd@\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 t\ufffd\r\ufffd\u03b9d\ufffd}\ufffdC\ufffd\u044f\u0013\ufffdS\ufffd\u01b1\u06a6\r\ufffdC\ufffdk\ufffddt",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019\uf95b\ufffd\"$\u000e\ufffd\u001f{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\u0006\ufffd y\ufffd\ufffd\u001b\u0018\u001cP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\u001b\ufffd\u0001~5\ufffd@\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8d8dd477e791b1d4501093fd4922e72836fab91",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019\uf95b\ufffd\"$\u000e\ufffd\u001f{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\u0006\ufffd y\ufffd\ufffd\u001b\u0018\u001cP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\u001b\ufffd\u0001~5\ufffd@\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
"tls_ja3": "ea217b0edcd93778471552ba0b796f81",
"tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": "\ufffd\ufffd\uf95b\ufffd\"$\ufffd{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\ufffd y\ufffd\ufffdP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\ufffd~5\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd}\n\n#",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 80 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 90,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019\uf95b\ufffd\"$\u000e\ufffd\u001f{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\u0006\ufffd y\ufffd\ufffd\u001b\u0018\u001cP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\u001b\ufffd\u0001~5\ufffd@\u001a\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
"tls_ja3": "ea217b0edcd93778471552ba0b796f81",
"tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\uf95b\ufffd\"$\ufffd{L\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd;\ufffd\ufffdc\ufffd\ufffd~\ufffd\r\n\ufffd\ufffd y\ufffd\ufffdP@\ufffd\"1\ufffd\ufffd\ufffd:\ufffd\ufffdm\ufffd~5\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd}\n\n#",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 80 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 90 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "45.156.128.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_wire_protocol",
"net_mongodb_wire_protocol",
"tls_clienthello"
]
}
|
|
|
TCP |
27017 · MONGODB
|
mongodb
|
Sonde port 27017/TCP
port 27017 tcp · via MONGODB:27017 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27017
Chemin / cible
—
Preuve honeypot — Sonde port 27017/TCP
Connexion détectée sur le port 27017 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_27017_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
65%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 211680,
"country": "PT",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "529d9b2894453058f3efabc7b1a0f869e5afeac0",
"event_fingerprint": "af0bf670397a78dc9d7687bcdee19adac845dc50",
"classification_reason": "Type \u00ab port_27017_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2c43cfd3f83ceab071449b3f56a1f3e4"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f1efaa49849ce2ec2df7b154399040d0350a0a17",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "port 27017 tcp \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_27017_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_27017_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "port 27017 tcp \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "45.156.128.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"net_mongodb_probe"
]
}
|
|
|
TCP |
27017 · MONGODB
|
mongodb
|
Sonde port 27017/TCP
port 27017 tcp · via MONGODB:27017 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27017
Chemin / cible
—
Preuve honeypot — Sonde port 27017/TCP
Connexion détectée sur le port 27017 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_27017_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Sistemas Informaticos, S.A.",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 211680,
"country": "PT",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "529d9b2894453058f3efabc7b1a0f869e5afeac0",
"event_fingerprint": "af0bf670397a78dc9d7687bcdee19adac845dc50",
"classification_reason": "Type \u00ab port_27017_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 211680,
"org": "Sistemas Informaticos, S.A.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2c43cfd3f83ceab071449b3f56a1f3e4"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f1efaa49849ce2ec2df7b154399040d0350a0a17",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "port 27017 tcp \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_27017_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_27017_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "port 27017 tcp \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"net_mongodb_probe"
]
}
|