|
|
TCP |
587 · SMTP SUBMISSION
|
smtp-submission
|
Sonde SMTP (soumission) (587/TCP)
port 587 tcp · via SMTP SUBMISSION:587 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 19e29534fd49dd27
Émulateur
SMTP-SUBMISSION
WAF
—
Recommandation
Surveiller
Tags
net_smtp_probe
smtp_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
587
Chemin / cible
—
Preuve honeypot — Sonde SMTP (soumission) (587/TCP)
Connexion détectée sur le port 587 (TCP) du capteur simulé.
Service
SMTP SUBMISSION
Payload
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « Sonde SMTP (soumission) (587/TCP) » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 40
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �<'�Vʑ�t���m-�߅��@���+33�:�H
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a35303220352e352e32204572726f723a20636f6d6d616e64206e6f74207265636f676e697a65640d0a","emulator_response_len":86,"bytes_in":243,"payload_entropy":5.917995008383122,"port_category":"well_known","org":"Alibaba (US) Technology Co., Ltd.","service":"smtp-submission","app_proto":"smtp-submission","asn":45102,"country":"SG","dst_port":587,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.7,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":40,"tag_count":3,"anomaly_count":0,"campaign_key":"38656b2004f3b9d34c8845ce9de8480d1d1a1340","event_fingerprint":"a4eb3bdaea671903d3ce718aa560d7f3c055f5fb","classification_reason":"Type \u00ab port_587_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":40},"named_classification_skipped":true,"named_candidate":"smtp_probe","service_name":"smtp-submission","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hin…
|
|
|
TCP |
8003 · HTTP
|
http
|
Sonde port 8003/TCP
port 8003 tcp · via HTTP:8003 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET / UA curl/7.74.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8003
Chemin / cible
/
Preuve honeypot — Sonde port 8003/TCP
Connexion détectée sur le port 8003 (TCP) du capteur simulé.
Pourquoi cette classification : Type « Sonde port 8003/TCP » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/7.74.0
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8003
User-Agent: curl/7.74.0
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":4,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"17bdda463fb70d98be11139377c20587f74ff713","http_host_hash":"c154689928b7acd22f7c91be032940fe6d3dd44c","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":108,"payload_entropy":4.961720752533011,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":8003,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":2.5,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":0,"protocol":43,"novelty":30},"risk_score":38,"tag_count":5,"anomaly_count":1,"campaign_key":"31033f2b4a123b63eb0b991f3ed68fea4f94ace5","event_fingerprint":"3be64bc70ec092b5d558f30d87e46f91e1086e0e","classification_reason":"Type \u00ab port_8003_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":0,"…
|
|
|
TCP |
8003 · HTTP ALT 8003
|
http-alt-8003
|
Sonde port 8003/TCP
port 8003 tcp · via HTTP ALT 8003:8003 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
HTTP-ALT-8003
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8003
Chemin / cible
—
Preuve honeypot — Sonde port 8003/TCP
Connexion détectée sur le port 8003 (TCP) du capteur simulé.
Service
HTTP ALT 8003
Payload
� \x1
Pourquoi cette classification : Type « Sonde port 8003/TCP » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":21,"payload_entropy":2.248529327128576,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http-alt-8003","app_proto":"http-alt-8003","asn":45102,"country":"SG","dst_port":8003,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"cac39ee3a151664dfbd2f6849d4a6bf68e6d74c3","event_fingerprint":"a075a9b36af1ca965f50b2b2b7569874936fc0f1","classification_reason":"Type \u00ab port_8003_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":35},"named_classification_skipped":true,"named_candidate":"rdp_probe","service_name":"http-alt-…
|