|
|
TCP |
28489
|
—
|
Sonde port
Sonde port · port 28489 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28489
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 28489,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "7af0a870a1bdecac6f802c93776386ccbc7375b8",
"event_fingerprint": "f289ffdad4317339f4707ede33bd516f1256c615",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 28489,
"risk_score": 33
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e28fddd2c394de1bd515e39a1fbaf1a35f11ffb",
"protocol_details": {
"port": 28489
},
"attack_vector": "Sonde port \u00b7 port 28489 \u00b7 (sonde \/ probe)",
"target_port_label": "28489",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 28489,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 28489
},
"attack_vector": "Sonde port \u00b7 port 28489 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "28489",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "28489"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"port:27609",
"port:28489",
"port:28506",
"port:29212",
"port:29871",
"port:30313",
"port:30686",
"port:31755"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
31755
|
—
|
Sonde RDP
rdp probe · port 31755 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
31755
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 31755,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6e7128454f91492361c65c57b607e6d276ab3a6d",
"event_fingerprint": "4ffe523d6c816485b6e1983e331012b78707b1a6",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 31755,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3818a74fc3b8208ee57b185221199173c1da6a8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 31755
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 31755 \u00b7 (sonde \/ probe)",
"target_port_label": "31755",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 31755,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 31755
},
"attack_vector": "rdp probe \u00b7 port 31755 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "31755",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "31755"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"port:27609",
"port:28506",
"port:29212",
"port:29871",
"port:30313",
"port:30686",
"port:31755"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
28506
|
—
|
Scan de ports
port scan syn · port 28506 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28506
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 28506,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ac7072ddff651ba9db338330fdb6dcc29f9f2e7a",
"event_fingerprint": "e45eff1b46dda77efba9f70c9a363a3f44d3a3cf",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 28506,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "628b1069925cfa81813f63174c1ea3c36ae0f176",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 28506
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "port scan syn \u00b7 port 28506 \u00b7 (reconnaissance)",
"target_port_label": "28506",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 28506,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 28506
},
"attack_vector": "port scan syn \u00b7 port 28506 \u00b7 (reconnaissance)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "28506",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "28506"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"port:27609",
"port:28506",
"port:29212",
"port:29364",
"port:29871",
"port:30313",
"port:30686"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
30313
|
—
|
Scan de ports
port scan syn · port 30313 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30313
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 30313,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "62c4762aedd1110da50a4f32ed6bdfc38d8e680e",
"event_fingerprint": "e4ebf260b585d88e87182918d5c5ba9b935e1b69",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 30313,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68f6e78e31baf5d358b352bfcbc0b7514de7c3bd",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 30313
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "port scan syn \u00b7 port 30313 \u00b7 (reconnaissance)",
"target_port_label": "30313",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 30313,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 30313
},
"attack_vector": "port scan syn \u00b7 port 30313 \u00b7 (reconnaissance)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "30313",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "30313"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:27609",
"port:29212",
"port:29364",
"port:29871",
"port:30313",
"port:30686"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
29212
|
—
|
Scan de ports
port scan syn · port 29212 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29212
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 29212,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f4f46da58e8fc258539228f21605f20892ed8615",
"event_fingerprint": "a86410ac978de15de9664d6a0218a376db6353e7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 29212,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c6213c83f81f8956f5acc4f32c7337c085d9877",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 29212
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "port scan syn \u00b7 port 29212 \u00b7 (reconnaissance)",
"target_port_label": "29212",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 29212,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 29212
},
"attack_vector": "port scan syn \u00b7 port 29212 \u00b7 (reconnaissance)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "29212",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "29212"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:27609",
"port:28300",
"port:29212",
"port:29364",
"port:29871",
"port:30686"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
27609
|
—
|
Sonde RDP
rdp probe · port 27609 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27609
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 27609,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d8c08e166e0412d9cd0a61706ec26aabe3b25067",
"event_fingerprint": "2391e47747aac06340092f5937f54d5b7760ff9a",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 27609,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "468580df126dbf99e559211fb746db0c1686e6a8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 27609
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 27609 \u00b7 (sonde \/ probe)",
"target_port_label": "27609",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 27609,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 27609
},
"attack_vector": "rdp probe \u00b7 port 27609 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "27609",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "27609"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:27609",
"port:28300",
"port:29364",
"port:29871",
"port:30686"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
30686
|
—
|
Sonde RDP
rdp probe · port 30686 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30686
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 30686,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e73065cad89e3412ba75cb521ca2e6ceb25c8d7b",
"event_fingerprint": "ac89aac446fef0a8d3d946a9fec252872c3a6ca4",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 30686,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "40fafd0a107fcdb891d7ed3b4ecd1169e7716ca9",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 30686
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 30686 \u00b7 (sonde \/ probe)",
"target_port_label": "30686",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 30686,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 30686
},
"attack_vector": "rdp probe \u00b7 port 30686 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "30686",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "30686"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:28300",
"port:29364",
"port:29871",
"port:30686"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
29871
|
—
|
Sonde RDP
rdp probe · port 29871 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29871
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 29871,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d7823bf920ebdbf894a9fc4bf78bc46972806a5f",
"event_fingerprint": "521c6ea62e8716d5cce0ac2f1b9d5e5c4766ffdd",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 29871,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b3dc3a2ab0b19aad2ca3b2b9c8434bf4c57b20f",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 29871
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 29871 \u00b7 (sonde \/ probe)",
"target_port_label": "29871",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 29871,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 29871
},
"attack_vector": "rdp probe \u00b7 port 29871 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "29871",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "29871"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:28300",
"port:29364",
"port:29871",
"port:31912"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
29364
|
—
|
Sonde port
Sonde port · port 29364 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29364
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 29364,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8d709c5d9c0eaa65d2bd82245c1dd705e25a98e3",
"event_fingerprint": "d406054b291cec7aaa8c7bb64dcb18b42ea08238",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 29364,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56f8757fcd0b2b54cbd52d8ea04fe7048c97d58a",
"protocol_details": {
"port": 29364
},
"attack_vector": "Sonde port \u00b7 port 29364 \u00b7 (sonde \/ probe)",
"target_port_label": "29364",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 29364,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 29364
},
"attack_vector": "Sonde port \u00b7 port 29364 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "29364",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "29364"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:27296",
"port:28300",
"port:29364",
"port:30667",
"port:31912"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
28300
|
—
|
Sonde RDP
rdp probe · port 28300 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28300
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 28300,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "895c430facaaede8a45f5d40d838f96aae769668",
"event_fingerprint": "1a95656b2455083da7c24d801eaebb0227ce6117",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 28300,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd690d7e4de96dabfd3061e6be9c22603c19ab0e",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 28300
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 28300 \u00b7 (sonde \/ probe)",
"target_port_label": "28300",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 28300,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 28300
},
"attack_vector": "rdp probe \u00b7 port 28300 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "28300",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "28300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:27296",
"port:28300",
"port:30667",
"port:31912"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
31912
|
—
|
Scan de ports
port scan syn · port 31912 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
31912
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 31912,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "944ea518bf2d20dc8048d62299578dc331110037",
"event_fingerprint": "e14e977a9b01895d33f39b6c0f86e1e3ab793150",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 31912,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a29942297e8ffa6e7beeff4c64da51f945c4202",
"protocol_details": {
"port": 31912
},
"attack_vector": "port scan syn \u00b7 port 31912 \u00b7 (reconnaissance)",
"target_port_label": "31912",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 31912,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 31912
},
"attack_vector": "port scan syn \u00b7 port 31912 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "31912",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "31912"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:27296",
"port:30667",
"port:31912"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
30667
|
—
|
Sonde port
Sonde port · port 30667 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30667
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 30667,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d4155a897a5633ad10a09662f4da4773c9b18ecf",
"event_fingerprint": "ce444c1c91f0c1f27e17e660ee64d006e53ec286",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 30667,
"risk_score": 33
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3059742ba17a427b5ac20db7f979a84438eb2450",
"protocol_details": {
"port": 30667
},
"attack_vector": "Sonde port \u00b7 port 30667 \u00b7 (sonde \/ probe)",
"target_port_label": "30667",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 30667,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 30667
},
"attack_vector": "Sonde port \u00b7 port 30667 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "30667",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "30667"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:27296",
"port:30667"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
27296
|
—
|
Sonde port
Sonde port · port 27296 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27296
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 27296,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "48f07c8e18f5eea5e805df8e89f345f2baa5dd4c",
"event_fingerprint": "bfa6916da99dca92b4bb5898f8308e89a5ee5f4b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 27296,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ffdae1f04954ee1b5337cb2445cd62facb8a635",
"protocol_details": {
"port": 27296
},
"attack_vector": "Sonde port \u00b7 port 27296 \u00b7 (sonde \/ probe)",
"target_port_label": "27296",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 27296,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 27296
},
"attack_vector": "Sonde port \u00b7 port 27296 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "27296",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "27296"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
17215
|
—
|
Sonde RDP
rdp probe · port 17215 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17215
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 17215,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "dd7a39c4d5ce6120f4c017a0eeacddb8e2da4247",
"event_fingerprint": "f5b4ffe51b63a6373599418cda4cb7c904d6c847",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 17215,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0313281cd324e1ab05f805d1179866b43d9cfa33",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 17215
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 17215 \u00b7 (sonde \/ probe)",
"target_port_label": "17215",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 17215,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 17215
},
"attack_vector": "rdp probe \u00b7 port 17215 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "17215",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17215"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:13092",
"port:13385",
"port:16619",
"port:17215",
"port:18011"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
13092
|
—
|
Scan de ports
port scan syn · port 13092 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13092
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 13092,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "7a193199174c37dde6f020f097ff82dfe4b78571",
"event_fingerprint": "766eeb5161dd4e69ff2ae49801bfa9908f8c25b2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 13092,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5fc0218c9568d563a59d42f3c063a643041818a4",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13092
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "port scan syn \u00b7 port 13092 \u00b7 (reconnaissance)",
"target_port_label": "13092",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13092,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13092
},
"attack_vector": "port scan syn \u00b7 port 13092 \u00b7 (reconnaissance)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "13092",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:13092",
"port:13385",
"port:16619",
"port:18011"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
18011
|
—
|
Sonde RDP
rdp probe · port 18011 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18011
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 18011,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "45b3afb83916a19ada8a6c98f4b57ce5ae5a505c",
"event_fingerprint": "0b9e1b39681ffd04ec1aff1c660065c4bf24742b",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 18011,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f10edd20b15c4babeb0965c73866ab4eeb43e612",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 18011
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 18011 \u00b7 (sonde \/ probe)",
"target_port_label": "18011",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 18011,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 18011
},
"attack_vector": "rdp probe \u00b7 port 18011 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "18011",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "18011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:13385",
"port:16619",
"port:18011"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
13385
|
—
|
Sonde RDP
rdp probe · port 13385 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13385
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 13385,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5b8174f291e551f060ad59b71b9b48172dcc5356",
"event_fingerprint": "63bf6b6610ef26268f1dba9227767e8eb5db3125",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 13385,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "258a1a0b5de6d0f8c4f65fabc6b1729ffdf77988",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13385
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 13385 \u00b7 (sonde \/ probe)",
"target_port_label": "13385",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13385,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13385
},
"attack_vector": "rdp probe \u00b7 port 13385 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "13385",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13385"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:13385",
"port:16619"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
16619
|
—
|
Sonde RDP
rdp probe · port 16619 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
16619
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 16619,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "809111be9b721c48d00c6bb73053d2a1b75e2d02",
"event_fingerprint": "2e54de52f488ef033bfb9f6594009996abaf12de",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 16619,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d982e5b9089d2d5a464c587ba2c614126f6c624",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 16619
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 16619 \u00b7 (sonde \/ probe)",
"target_port_label": "16619",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 16619,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 16619
},
"attack_vector": "rdp probe \u00b7 port 16619 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "16619",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "16619"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
16204
|
—
|
Sonde RDP
rdp probe · port 16204 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
16204
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 16204,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c49621fe1192bc5d724e0c4a8d954b70bb751bd5",
"event_fingerprint": "512ecfad6d5813dc66e6e05a1c1912a7f667817e",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 16204,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c2cb06b89481c202bed3c8fd96168c270ece552",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 16204
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 16204 \u00b7 (sonde \/ probe)",
"target_port_label": "16204",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 16204,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 16204
},
"attack_vector": "rdp probe \u00b7 port 16204 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "16204",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "16204"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:13411",
"port:16204",
"port:17747"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
17747
|
—
|
Sonde RDP
rdp probe · port 17747 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17747
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 17747,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3a8e8307bf004b1e949649cb88ae540d43e0b132",
"event_fingerprint": "64aa0b4eed760cdb0ef819f63bc7103aa19eed4a",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 17747,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec2927137e6ffcd66edb1b6caae3051aec2db24b",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 17747
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 17747 \u00b7 (sonde \/ probe)",
"target_port_label": "17747",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 17747,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 17747
},
"attack_vector": "rdp probe \u00b7 port 17747 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "17747",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17747"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:13236",
"port:13411",
"port:17747"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
13411
|
—
|
Sonde RDP
rdp probe · port 13411 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13411
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 13411,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "487c7539fa3cd80df1079b0101835e1ea8bb4b40",
"event_fingerprint": "e0983f369ea6a42485628281171588a8278e5365",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 13411,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54aee5a6a61860c8de91ab05398e4b06c4f739eb",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13411
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 13411 \u00b7 (sonde \/ probe)",
"target_port_label": "13411",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13411,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13411
},
"attack_vector": "rdp probe \u00b7 port 13411 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "13411",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13411"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:13236",
"port:13411"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
13236
|
—
|
Sonde RDP
rdp probe · port 13236 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13236
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 13236,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f3d12d6117383a867c1da7b27d09f1b638b17966",
"event_fingerprint": "26d4a462ab6e4df58d11a369cb4bed959ae7f9dc",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 13236,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "570079fa7f125d8beb49bbb9098781bff23f7ef8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13236
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 13236 \u00b7 (sonde \/ probe)",
"target_port_label": "13236",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13236,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13236
},
"attack_vector": "rdp probe \u00b7 port 13236 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "13236",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13236"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:13236",
"port:16639"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
16639
|
—
|
Sonde RDP
rdp probe · port 16639 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
16639
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 16639,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8f5bd1a4517e9b9c48a70b9ea59b1a4cea523d06",
"event_fingerprint": "0f78f0c2085868d5677cd6d73d82fef0b3c5aa20",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 16639,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a8411f483e8ab8159f4c1bdc0f91f1bed1753f7",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 16639
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 16639 \u00b7 (sonde \/ probe)",
"target_port_label": "16639",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 16639,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 16639
},
"attack_vector": "rdp probe \u00b7 port 16639 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "16639",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "16639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:13382",
"port:14494",
"port:15113",
"port:15208",
"port:16639"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
14494
|
—
|
Sonde RDP
rdp probe · port 14494 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14494
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 14494,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2607c9c5c73242b83b62c11716e506832079fc5c",
"event_fingerprint": "169ff910a3c77fd98a6732383e3b2890c403d248",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 14494,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2d37e4982bce37cf784545b40f96c54e2cb2ab8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 14494
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 14494 \u00b7 (sonde \/ probe)",
"target_port_label": "14494",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 14494,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 14494
},
"attack_vector": "rdp probe \u00b7 port 14494 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "14494",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "14494"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:13382",
"port:14494",
"port:15113",
"port:15208",
"port:17442"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
15208
|
—
|
Sonde RDP
rdp probe · port 15208 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15208
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 15208,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "b8726713cb4c92a7c72fb94fde97e621ede00d2e",
"event_fingerprint": "cb0d3afcfb1595db03c827f8b50334b4e0e2785f",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 15208,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "854d824ad7d443a2d79fa46c0f6a11e3d7c7ec5a",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 15208
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 15208 \u00b7 (sonde \/ probe)",
"target_port_label": "15208",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 15208,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 15208
},
"attack_vector": "rdp probe \u00b7 port 15208 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "15208",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "15208"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:13382",
"port:15113",
"port:15208",
"port:17442"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
15113
|
—
|
Sonde RDP
rdp probe · port 15113 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15113
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 15113,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6bbafb1f0a114475caee3c5fd337f501fe2432fe",
"event_fingerprint": "f1dfc79bfd9379012087feb2f07b19d75c0279f9",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 15113,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19fc768ef5b5c64bcdfe35214e60ee73ef9c8cc2",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 15113
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 15113 \u00b7 (sonde \/ probe)",
"target_port_label": "15113",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 15113,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 15113
},
"attack_vector": "rdp probe \u00b7 port 15113 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "15113",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "15113"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:13382",
"port:14332",
"port:14952",
"port:15113",
"port:17442",
"port:18926"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
13382
|
—
|
Sonde RDP
rdp probe · port 13382 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13382
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 13382,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f6a1a64b929857528119875b0e666c0bb5ddffeb",
"event_fingerprint": "9cb415836f4e3154e77b1f81fa54e84cdcea56dd",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 13382,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37e8fb03f2a7aa12fee92a0786c6def81357207e",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13382
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 13382 \u00b7 (sonde \/ probe)",
"target_port_label": "13382",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13382,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 13382
},
"attack_vector": "rdp probe \u00b7 port 13382 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "13382",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13382"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:13382",
"port:14332",
"port:14952",
"port:15596",
"port:17442",
"port:18926"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
17442
|
—
|
Sonde RDP
rdp probe · port 17442 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17442
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 17442,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "044b52af12f29519ae56ef568b1ae545310dec4b",
"event_fingerprint": "4d3a62ded7f2b4e1293267ff5fad7ceb208152d9",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 17442,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97c63a1cc8d6e2a62b7e4e8eb0134143892bac70",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 17442
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 17442 \u00b7 (sonde \/ probe)",
"target_port_label": "17442",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 17442,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 17442
},
"attack_vector": "rdp probe \u00b7 port 17442 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "17442",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17442"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:14332",
"port:14952",
"port:15596",
"port:17442",
"port:18926"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
14332
|
—
|
Sonde RDP
rdp probe · port 14332 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14332
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 14332,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a75bdd24316dd760db85047b257f4fbfea107907",
"event_fingerprint": "673e73ce2bb7427cea3e0fc6ef10e076475eed0c",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 14332,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ed86be78e9823821d4650309b922f1f102a0b9a",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 14332
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 14332 \u00b7 (sonde \/ probe)",
"target_port_label": "14332",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 14332,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 14332
},
"attack_vector": "rdp probe \u00b7 port 14332 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "14332",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "14332"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:14332",
"port:14952",
"port:15596",
"port:18926",
"port:18992"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
14952
|
—
|
Sonde RDP
rdp probe · port 14952 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14952
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 14952,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e946e4efec4c73837b8d3a834c599225c0e3a849",
"event_fingerprint": "ae69a6c22d5a450ce70358d6c08b4de427a5a046",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 14952,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b71653d6702d4b1e658e481744c5efe13a66f86f",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 14952
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 14952 \u00b7 (sonde \/ probe)",
"target_port_label": "14952",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 14952,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 14952
},
"attack_vector": "rdp probe \u00b7 port 14952 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "14952",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "14952"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:14952",
"port:15596",
"port:18926",
"port:18992"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
18926
|
—
|
Sonde RDP
rdp probe · port 18926 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18926
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 18926,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "dd98f7403fdaea0b8d60578f1b666c39dda7a4e9",
"event_fingerprint": "c992d0015f817e4f20a8f81aef6d78b215e4a895",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 18926,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23236d0d04a840f1c9dbaff8d11399f9378cb710",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 18926
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 18926 \u00b7 (sonde \/ probe)",
"target_port_label": "18926",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 18926,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 18926
},
"attack_vector": "rdp probe \u00b7 port 18926 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "18926",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "18926"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:15596",
"port:18926",
"port:18992"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
15596
|
—
|
Sonde RDP
rdp probe · port 15596 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15596
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 15596,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cd41fca3ee156c574ce0c11a07f3dcac32e12b81",
"event_fingerprint": "80522e46cd663af8bdb8f76800bbdc2edc2cc049",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 15596,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e6820d5411965b81f309c762c1b51ac7efdec2b",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 15596
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 15596 \u00b7 (sonde \/ probe)",
"target_port_label": "15596",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 15596,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 15596
},
"attack_vector": "rdp probe \u00b7 port 15596 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "15596",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "15596"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:15596",
"port:18992"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
18992
|
—
|
Sonde RDP
rdp probe · port 18992 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18992
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 18992,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c081a5f4c65e6708a3f75bb871f6733a22905a2e",
"event_fingerprint": "213ed7b3fb6e55f51cdf6496fea72c956843cd74",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 18992,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5bcd171c9ac3d0dd7b831ea8849bb7443c025c7e",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 18992
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 18992 \u00b7 (sonde \/ probe)",
"target_port_label": "18992",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 18992,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 18992
},
"attack_vector": "rdp probe \u00b7 port 18992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "18992",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "18992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
11108
|
—
|
Sonde RDP
rdp probe · port 11108 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11108
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 11108,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "09f03a6ea7af2b2635fcb2367465bb47d4de1567",
"event_fingerprint": "d03defa5550c8d35a3c2d1ca379126ecb6d8a280",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 11108,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f7c40e3afae4c82a19da3b1020910b4fe34fb7a",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11108
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 11108 \u00b7 (sonde \/ probe)",
"target_port_label": "11108",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 11108,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11108
},
"attack_vector": "rdp probe \u00b7 port 11108 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "11108",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "11108"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:11108",
"port:11181",
"port:11760",
"port:12623",
"port:7078",
"port:9966"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
12623
|
—
|
Sonde RDP
rdp probe · port 12623 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12623
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 12623,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cfa698c2461664c91feb7830dc35db1293a8c79f",
"event_fingerprint": "ed60681222a9a827f9c3b42bbd0dc21f43fa5c6d",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 12623,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca157f3573b5611c58c8f7ae3c689c4aa8534e70",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12623
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 12623 \u00b7 (sonde \/ probe)",
"target_port_label": "12623",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 12623,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12623
},
"attack_vector": "rdp probe \u00b7 port 12623 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "12623",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12623"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:11181",
"port:11760",
"port:12467",
"port:12623",
"port:7078",
"port:9966"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
9966
|
—
|
Scan de ports
port scan syn · port 9966 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9966
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 9966,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1967dad7b1095d7e9c0c677df5f6cf9fb3ec9d4c",
"event_fingerprint": "dd56ef32c53b1ee37749df6ae6eac6a615210624",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9966,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba1cdfbce7a33217e9e08d3ff804eb80f0f7d4cc",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 9966
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "port scan syn \u00b7 port 9966 \u00b7 (reconnaissance)",
"target_port_label": "9966",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9966,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 9966
},
"attack_vector": "port scan syn \u00b7 port 9966 \u00b7 (reconnaissance)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "9966",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9966"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:11181",
"port:11760",
"port:12467",
"port:7078",
"port:7210",
"port:9966"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
11760
|
—
|
Sonde RDP
rdp probe · port 11760 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11760
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 11760,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "aaace9d64ca9df70a42917fa863791fb665c6906",
"event_fingerprint": "deedea20d54e1daff9aa3c6891e8dc6f72ffeeaf",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 11760,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e09b1d4d70e1d776000dc922ae1dadc9238f143e",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11760
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 11760 \u00b7 (sonde \/ probe)",
"target_port_label": "11760",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 11760,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11760
},
"attack_vector": "rdp probe \u00b7 port 11760 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "11760",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "11760"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:10919",
"port:11181",
"port:11760",
"port:12467",
"port:7078",
"port:7210"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
11181
|
—
|
Sonde RDP
rdp probe · port 11181 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11181
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 11181,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c242c4154c03d1cf878657b997a977e713923c49",
"event_fingerprint": "a1050c7965b51dd7b26549fa26dd004ba1d89670",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 11181,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b722e05e8b2ed220c41cb843ec2e2ebe647b0f9",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11181
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 11181 \u00b7 (sonde \/ probe)",
"target_port_label": "11181",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 11181,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11181
},
"attack_vector": "rdp probe \u00b7 port 11181 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "11181",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "11181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:10919",
"port:11181",
"port:12467",
"port:7078",
"port:7210"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
7078
|
—
|
Sonde RDP
rdp probe · port 7078 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7078
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 7078,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "76ec704e4c505853ff857ca16cdb20aa276416a8",
"event_fingerprint": "f0d9ca6319a43bf18976128162423341cdf76b7c",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 7078,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9930d475f2710d6f2aae6612c0b934a947b590fa",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7078
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 7078 \u00b7 (sonde \/ probe)",
"target_port_label": "7078",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7078,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7078
},
"attack_vector": "rdp probe \u00b7 port 7078 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "7078",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7078"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:10919",
"port:12467",
"port:7078",
"port:7210"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
12467
|
—
|
Scan de ports
port scan syn · port 12467 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12467
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 12467,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "89f5c2174a81c73ad85dae817730c221ba819e07",
"event_fingerprint": "d69fc1e64ff3c83b827ee1cda5dc453b9590e897",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 12467,
"risk_score": 42
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81b3774f367dc12ec65113a9a8c8c6db0a595ebc",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12467
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "port scan syn \u00b7 port 12467 \u00b7 (reconnaissance)",
"target_port_label": "12467",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 12467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12467
},
"attack_vector": "port scan syn \u00b7 port 12467 \u00b7 (reconnaissance)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "12467",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:10919",
"port:12467",
"port:7210",
"port:7309"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7210
|
—
|
Sonde RDP
rdp probe · port 7210 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7210
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 7210,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "284b2fea8491f2763a08980d68940f724f264f0e",
"event_fingerprint": "e3c86b4e0bb4e5df376a2ce218e680e8f30f3616",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 7210,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "17d3b57ab30a5cd47d34305ed9c8b2e5a00dcff3",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7210
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 7210 \u00b7 (sonde \/ probe)",
"target_port_label": "7210",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7210,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7210
},
"attack_vector": "rdp probe \u00b7 port 7210 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "7210",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:10919",
"port:7210",
"port:7309"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
10919
|
—
|
Sonde RDP
rdp probe · port 10919 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10919
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 10919,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "295d8a229f36963aef1ae393ab6caddf41ed4687",
"event_fingerprint": "21762520a66997ceeb3ba93f3e9bff12387bb4ee",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 10919,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "539a07842c90dfa650bc4231d393db4dc8ac85d1",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 10919
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 10919 \u00b7 (sonde \/ probe)",
"target_port_label": "10919",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 10919,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 10919
},
"attack_vector": "rdp probe \u00b7 port 10919 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "10919",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10919"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:10919",
"port:7309"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
7309
|
—
|
Sonde RDP
rdp probe · port 7309 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7309
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 7309,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "90a10d1799b9ba34a86dad6e361776438e1b42f6",
"event_fingerprint": "83474b82301b18b0eaafb96dd2661c34f1bcb993",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 7309,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f1f58030647c9505e8594a72fb3c50840b1339d",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7309
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 7309 \u00b7 (sonde \/ probe)",
"target_port_label": "7309",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7309,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7309
},
"attack_vector": "rdp probe \u00b7 port 7309 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "7309",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7309"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:7270",
"port:7309"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
7270
|
—
|
Sonde RDP
rdp probe · port 7270 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7270
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 7270,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "db7e9fd318d54f9dd9d48b26d0f8a5ee337eb12b",
"event_fingerprint": "0c74078ccae49513f65168f79d0b61230d561a46",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 7270,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df0038c291e6d956b9b386dd01c1e02ddd4e0854",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7270
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 7270 \u00b7 (sonde \/ probe)",
"target_port_label": "7270",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7270,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 7270
},
"attack_vector": "rdp probe \u00b7 port 7270 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "7270",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7270"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:12590",
"port:7270"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
12590
|
—
|
Sonde RDP
rdp probe · port 12590 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12590
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 12590,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "21786dd4ecfe491fc9edc5bc59114f46050dde98",
"event_fingerprint": "671697c49a64443f8a94f70222561bf2d3090509",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 12590,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afd5a3ef8b7715ea2cf2203542b33fe27360deda",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12590
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 12590 \u00b7 (sonde \/ probe)",
"target_port_label": "12590",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 12590,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12590
},
"attack_vector": "rdp probe \u00b7 port 12590 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "12590",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12590"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:12512",
"port:12590",
"port:8990"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
8990
|
—
|
Sonde RDP
rdp probe · port 8990 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8990
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 8990,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "9caf78eea63ec0537dcf24f8fdfc29d73dfb9a8b",
"event_fingerprint": "9d511d7d54608682c2fb0f722adc1b3e5f7a2c0c",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 8990,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d03fe193bc9e99b7102ba1759b061a815235fc1d",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 8990
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 8990 \u00b7 (sonde \/ probe)",
"target_port_label": "8990",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 8990,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 8990
},
"attack_vector": "rdp probe \u00b7 port 8990 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "8990",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8990"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:12512",
"port:8990"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
12512
|
—
|
Sonde RDP
rdp probe · port 12512 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12512
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 12512,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "9e1335b430da04048193167c0f91e56759530998",
"event_fingerprint": "0f92451ccfc82e4046c8085ccc28210c9a23b502",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 12512,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b46f300b446d63b20bdb4b203138c6e56aef3b3c",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12512
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 12512 \u00b7 (sonde \/ probe)",
"target_port_label": "12512",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 12512,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12512
},
"attack_vector": "rdp probe \u00b7 port 12512 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "12512",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12512"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"port:10523",
"port:11788",
"port:12069",
"port:12512",
"port:8903",
"port:9405"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
12069
|
—
|
Sonde RDP
rdp probe · port 12069 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12069
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 12069,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e7ed77c67797ca6d87e028f80a406e3953cadc70",
"event_fingerprint": "0a27918482498b1bf8cd1f7c415cb497f8e8d310",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 12069,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8490b118980644755eeb170dcf58a96b857c5263",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12069
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 12069 \u00b7 (sonde \/ probe)",
"target_port_label": "12069",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 12069,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 12069
},
"attack_vector": "rdp probe \u00b7 port 12069 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "12069",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"port:10523",
"port:11788",
"port:12069",
"port:8903",
"port:9405"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
11788
|
—
|
Sonde RDP
rdp probe · port 11788 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11788
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 11788,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "288f61026a44358a33eececc77ebc152ebfa1124",
"event_fingerprint": "924b70dca521abc5d15ac5088da98bac9079560b",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 11788,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb3d498b9149e1e183a4e8d171bf63bcb170c7e7",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11788
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 11788 \u00b7 (sonde \/ probe)",
"target_port_label": "11788",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 11788,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 11788
},
"attack_vector": "rdp probe \u00b7 port 11788 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "11788",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "11788"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:10523",
"port:11788",
"port:8903",
"port:9405"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
9405
|
—
|
Sonde RDP
rdp probe · port 9405 · (sonde / probe)
|
Faible
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9405
Chemin / cible
—
Payload
/*� Cookie: mstshash=Administr
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
/*� Cookie: mstshash=Administr
Meta JSON brut
{
"bytes_in": 47,
"payload_entropy": 4.155132734426204,
"port_category": "registered",
"org": "Data Campus Limited",
"service": null,
"app_proto": null,
"asn": 215929,
"country": "NL",
"dst_port": 9405,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0d58204f1a14e504356997ad556164acff35f9bf",
"event_fingerprint": "c6bc00cd93bfca5ed6f45a93df5e771e392fdc8f",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 215929,
"org": "Data Campus Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 9405,
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "907469a2d823f077c139424f4c012f9281115ebb",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 9405
},
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"attack_vector": "rdp probe \u00b7 port 9405 \u00b7 (sonde \/ probe)",
"target_port_label": "9405",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9405,
"protocol_emulated": null,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 9405
},
"attack_vector": "rdp probe \u00b7 port 9405 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
"target_port_label": "9405",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9405"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:10523",
"port:11981",
"port:8903",
"port:9405"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
|