|
|
TCP |
5061 · SIP TLS
|
sip-tls
|
Sonde HTTP smuggling
http smuggling probe · via SIP TLS:5061 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SIP-TLS
WAF
—
Recommandation
Investiguer
Tags
net_sip_voip_probe
sip_tls_emulated
sip_voip_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5061
Chemin / cible
—
Service
SIP TLS
Payload
OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/TCP nm;branch=foo From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
SIP protocol
HTTP OPTIONS method
SIP OPTIONS
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS sip:nm SIP/2.0
Via: SIP/2.0/TCP nm;branch=foo
From: <sip:nm@nm>;tag=root
To: <sip:nm2@nm2>
Call-ID: 50000
CSeq: 42
Requête brute (extrait)
OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/TCP nm;branch=foo From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42 OPTIONS Max-Forwards: 70 Content-Length: 0 Contact: <sip:nm@nm> Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5349502f322e3020323030204f4b0d0a5669613a205349502f322e302f55445020686f6e6579706f740d0a46726f6d3a203c7369703a686f6e6579706f74406c6f63616c3e3b7461673d6870310d0a546f3a203c7369703a70726f6265406c6f63616c3e3b7461673d6870320d0a43616c6c2d49443a20686f6e6579706f742d",
"emulator_response_len": 215,
"bytes_in": 227,
"payload_entropy": 5.180133198610013,
"port_category": "registered",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "sip-tls",
"app_proto": "sip-tls",
"asn": 45102,
"country": "US",
"dst_port": 5061,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5be3b60591346242b76f64d001171712d237d13a",
"event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0384",
"pat-0420",
"pat-0535"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SIP protocol",
"HTTP OPTIONS method",
"SIP OPTIONS"
],
"pattern_ids": [
"pat-0842",
"pat-0384",
"pat-0420",
"pat-0535"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sip-tls",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "87f89176eb26212ca06d0da7f91c9b39",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5061,
"service": "sip-tls",
"service_name": "sip-tls",
"risk_score": 52
},
"payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 ",
"request_sample": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application\/sdp\r\n\r\n\r\n\r\n",
"payload_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
"evidence": {
"request_sample": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application\/sdp\r\n\r\n\r\n\r\n",
"payload_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75c1d295990a98fd7dbb587750268061ca80536d",
"protocol_details": {
"payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"evidence_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
"attack_vector": "http smuggling probe \u00b7 via SIP TLS:5061 \u00b7 (tentative d'exploit)",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SIP TLS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sip-tls",
"service_label_fr": "SIP TLS",
"dst_port": 5061,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"attack_vector": "http smuggling probe \u00b7 via SIP TLS:5061 \u00b7 (tentative d'exploit)",
"evidence_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip_tls",
"service_banner": "honeypot-sip-tls",
"service_os": "linux",
"dst_port": "5061"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_sip_voip_probe",
"sip_tls_emulated",
"sip_voip_probe"
]
}
|
|
|
TCP |
502 · MODBUS
|
modbus
|
Sonde port 502/TCP
port 502 tcp · via MODBUS:502 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
502
Chemin / cible
—
Preuve honeypot — Sonde port 502/TCP
Connexion détectée sur le port 502 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_502_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 41
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000020000",
"emulator_response_len": 5,
"bytes_in": 19,
"payload_entropy": 1.8784775129881184,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "modbus",
"app_proto": "modbus",
"asn": 45102,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 41,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1df3a12ec0dbfaa23bb48ea99bf5912c8211349a",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab port_502_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "modbus",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
"path_pattern_hash": "2f8b196e002aab50f4ffbc3370e2fb4f"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 41
},
"payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_502_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5e8f2048488e9652cb9269027ab91157e4ce557",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "\ufffd",
"attack_vector": "port 502 tcp \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_502_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_502_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "port 502 tcp \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe"
]
}
|
|
|
TCP |
502 · MODBUS
|
modbus
|
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
modbus_emulated
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
GET / HTTP/1.1 Host: 62.3.50.33:502 User-Agent: curl/7.64.1 Accept: */*
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:502
User-Agent: curl/7.64.1
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "008302",
"emulator_response_len": 3,
"bytes_in": 78,
"payload_entropy": 4.838376302956888,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "modbus",
"app_proto": "modbus",
"asn": 45102,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 46,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2ce5d993e403ac5b5509d46fe50fcab53965d82b",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 22
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d79f085644b7d6c5e0614a93ce6d758a",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 22
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*\r\n\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b41eacc0443016443323d9b661a2e9a669fc2fd4",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 22
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 22,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: curl\/7.64.1\r\nAccept: *\/*",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"modbus_emulated",
"net_modbus_probe"
]
}
|
|
|
TCP |
502 · MODBUS
|
modbus
|
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T0836
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Ot Modbus Write
Ot Modbus Write Fc
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �<'�Vʑ�t���m-�߅��@���+33�:�H
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000020000",
"emulator_response_len": 5,
"bytes_in": 243,
"payload_entropy": 5.917995008383122,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "modbus",
"app_proto": "modbus",
"asn": 45102,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "71872130bb5b9bc70e08e1195915be62e8b7489c",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 161,
"precision_signals": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f92e510aaeca6871a90045d62102af72",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 38
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003I\u0006\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\u000e\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffd\u0019N\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003I\u0006\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\u000e\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffd\u0019N\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd<'\ufffdV\u0291\ufffdt\ufffd\ufffd\ufffdm-\ufffd\u07c5\ufffd\ufffd@\ufffd\ufffd\ufffd+33\ufffd:\ufffdH",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003I\u0006\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\u000e\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffd\u0019N\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "991d99c0166034738efa72c63ab1dc5717678957",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003I\u0006\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\u000e\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffd\u0019N\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffdN\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Modbus Write",
"Ot Modbus Write Fc",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003I\u0006\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\u000e\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffd\u0019N\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdi\ufffdY\ufffd\ufffd\ufffde-\ufffdUd]\ufffd\ufffdb8\ufffdg\ufffd\ufffd9dZ8f g\ufffd\ufffdi\ufffd\ufffd\ufffd\u02f0\ufffdN\u05bd\ufffdg|p\ufffd\ufffd<Z\ufffd\ufffdT\ufffd\ufffd8'O;&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
502 · MODBUS
|
modbus
|
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T0836
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
*� +
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Ot Modbus Write
Ot Modbus Write Fc
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "008302",
"emulator_response_len": 3,
"bytes_in": 11,
"payload_entropy": 2.4040097573248604,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "modbus",
"app_proto": "modbus",
"asn": 45102,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1df3a12ec0dbfaa23bb48ea99bf5912c8211349a",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 161,
"precision_signals": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"matched_patterns": [
"pat-0554"
],
"matched_pattern_names": [
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ebb65fd37e1706f69e0a7fe8a2d5f18a",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 38
},
"payload_preview": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"request_sample": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"payload_snippet": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"evidence": {
"request_sample": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"payload_snippet": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3fa95aa3e436282ff9b39e9a79ecc1ed0c50b406",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "*\ufffd+",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Modbus Write",
"Ot Modbus Write Fc",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "*\ufffd\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*\ufffd+",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe"
]
}
|