Renseignement sur les menaces

France

62.210.142.165

FAI Scaleway SAS Première vue 25/07/2026 19:48 UTC Dernière vue 25/07/2026 19:59 UTC Risque Moyen

Période analysée : 2026-06-26 → 2026-07-26

Activité suspecte — risque 47/100 (Moyen) — MITRE TA0043 — confiance 64 % — via HTTP — multi-protocole (9 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 61/100 Moyen

Première observation 25/07/2026 19:48 UTC

Dernière observation 25/07/2026 19:59 UTC

Événements (période) 140

MITRE ATT&CK principal T1046 84 occurrences

Activité suspecte — risque 47/100 (Moyen) — MITRE TA0043 — confiance 64 % — via HTTP — multi-protocole (9 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 50%

Confiance 64 % — Score WAF 84 · Bonus corrélation +14 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 12876 · 62.210.0.0/16 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 140 événements sur la période pour cette IP.

51.159.110.167 Sonde port 26/07/2026 10:29 UTC
51.15.59.186 minecraft probe 25/07/2026 13:18 UTC
62.210.142.178 SSRF 25/07/2026 09:49 UTC
195.154.103.239 file upload abuse 25/07/2026 07:53 UTC
163.172.143.147 minecraft probe 24/07/2026 22:31 UTC
62.210.216.121 Scan vulnérabilités 24/07/2026 21:22 UTC
51.158.205.203 Sonde port 22/TCP 24/07/2026 15:37 UTC
51.158.248.123 file upload abuse 24/07/2026 14:16 UTC

Événements (filtres)

140

Première observation

25/07/2026 19:48 UTC

Dernière observation

25/07/2026 19:59 UTC

Dernière activité (filtres)

25/07/2026 19:59 UTC

Événements 7j

140

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 80 HTTP ALT 8880 TCP 11 Telnet TCP 9 HTTP ALT 81 TCP 6 RTSP TCP 5 SSH TCP 3 TLS TCP 3

HTTP

HTTP ALT 8880

Telnet

HTTP ALT 81

RTSP

SSH

Géolocalisation

Origine réseau déclarée

France unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Scaleway SAS 0 Port 25461 port_scan_syn

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:25461 · (reconnaissance) · → /favicon.ico

Détails protocole

Méthode: GET
Chemin: /favicon.ico
User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)

Aperçu payload

GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.c

Port / service

25461 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 50 % — 3 tag(s) WAF

Technique MITRE

TA0043

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

64% Corrélation +14

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

140 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

140 événement(s) — page 1/3

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /login.html	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /login.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co Requête brute (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "58165cf539b8f3baebb7b0688b61c0c6bd9c1221", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 184, "payload_entropy": 5.21285021893925, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "edc3063640302581a1483a9fd6bcc5f7ff16daad", "event_fingerprint": "7f1d3d275801c1e0d8122a4218163553049593c5", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "945314dc646cfca37ed556a3545d86e8", "path_pattern_hash": "4bd05a9ef933daa96fd6cd3e76e0cd59" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "evidence": { "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "80e0db5f03474f7d185a13582a0d09e1b92d71f3", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html", "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /login.jsp	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.jsp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /login.jsp Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.jsp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "jsp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "b41f25730b5d6fa1c33072bb9c8d43aa7ba33e8e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.230364640539313, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5208afbef6481b6719632956417942af0974b5b4", "event_fingerprint": "c4387a92865fa676acea900a466644b1ba4e4bf2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "b21c5e5568859c5761ec6f55c858f445", "path_pattern_hash": "b16b806d2fba9e3fd94bdb22d055d68f" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1a4d86644d3b226862f638b859b7f47fb86e82e", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp", "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /login	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/gen Requête brute (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 179, "payload_entropy": 5.212632709406276, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5208afbef6481b6719632956417942af0974b5b4", "event_fingerprint": "c078f9018890209922f37e18af1f2630bd452ca2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "d34d82e638296f637e98ed3e5cb651d2", "path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "evidence": { "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5fbcb5ecc3a3027f6f466c1b3169af00e2f04a5e", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login", "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /doc/index.html	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /doc/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /doc/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /doc/index.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /doc/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.noki Requête brute (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "94cbd295967620830d1ac8eefc3dab9ec7f6dbc6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 188, "payload_entropy": 5.227758735003378, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c42c18635b9785ce3072b1f0000cfa3977418e38", "event_fingerprint": "60fa3743bd6c40b39b757c0be5e7527d3a12485c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "d8959e7fa8025249e68e667b10d79ea6", "path_pattern_hash": "a7598671652528e5b3f1e930e03e0a00" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "evidence": { "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "052470f14a9650cdd1a5410188c42bb8cce7b4fa", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html", "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /remote/login	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /remote/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /remote/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /remote/login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) CVE-2024-21762 FortiOS MITRE T1210 remote svc LFI Double-dot bypass Ligne de requête `GET /remote/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia. Requête brute (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "907a2da0c21f11374cb55d43385e76e234aedbef", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 186, "payload_entropy": 5.186087256397284, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 58, "tag_count": 5, "anomaly_count": 0, "campaign_key": "1b8210cdb993822f9f0d66c68035e2db76d3730e", "event_fingerprint": "a7b7a8111a68d6bde3282c95a04772b3edf77afc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0721", "pat-0803", "pat-0103" ], "matched_pattern_names": [ "CVE-2024-21762 FortiOS", "MITRE T1210 remote svc", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0721", "pat-0803", "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "ecf5bcb4b30f45522f66b18bf861486a", "path_pattern_hash": "3e486ce7203b6fa4cdeca113b89969b2" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "evidence": { "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e8a64c1f1600875d15afd0548f8a865c0bc74f1f", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login", "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_vpn_portal_scan" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /admin/login.asp	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /admin/login.asp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/login.asp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /admin/login.asp Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET Probe /admin/login ActiveMQ console Ligne de requête `GET /admin/login.asp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nok Requête brute (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "asp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "74ee0e33710b439680e8c9dc84b7100d7e7738f2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 189, "payload_entropy": 5.20434685198559, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 59, "tag_count": 8, "anomaly_count": 0, "campaign_key": "c036e373b32fc955ffa418afe306ae46774d424b", "event_fingerprint": "7e8ee7c6cb9e2b3b2d5b3966b9ab5303aabc9649", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "Probe \/admin\/login", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "3d781d75290204c19ee6ad527a2ca000", "path_pattern_hash": "742c42cda425189da92779d492183288" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "evidence": { "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "912c9731fbd09e05b66e0612ff7d156d42f44cab", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp", "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /web/	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /web/ UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /web/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /web/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /web/ HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/geno Requête brute (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "be2a319b834b23bb5db3b9088093e167eb951dfe", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 178, "payload_entropy": 5.218114965259551, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c42c18635b9785ce3072b1f0000cfa3977418e38", "event_fingerprint": "3cff151cf45103a6e673dfd9b30dc6c426661f53", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "4f0ebd263e5b2ee03b39887c3247c467", "path_pattern_hash": "d10f26a614111c156a22417b020f287c" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "evidence": { "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "501b7ef38a3d2867e36b75d2c22f2e1ebfcbe4d5", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/", "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /webpages/login.html	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /webpages/login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /webpages/login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /webpages/login.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /webpages/login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www Requête brute (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "3557966eb4cf90eaeaf0c2c998dc2912f0a3d646", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 193, "payload_entropy": 5.205939401045952, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c42c18635b9785ce3072b1f0000cfa3977418e38", "event_fingerprint": "f390b2c73a2d716ad1b2fa8c857a35db5dbbe1cc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "d55a208340de843e13f1e7d710f06075", "path_pattern_hash": "048ac28c307da42b70c2a2400dc8fdcb" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "evidence": { "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d8c43acf1c3e5f0aedce11fc1bdb6f12dba5033", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html", "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:42 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /favicon.ico	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50% Confiance classification 64% Corrélation +14 Risque capteur Moyen · 47 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE TA0043 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.c Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 185, "payload_entropy": 5.231314433381368, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "edc3063640302581a1483a9fd6bcc5f7ff16daad", "event_fingerprint": "7643fd485e6e76aa029d77b564a3d354cbeb6bd9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.64, "classification_confidence": 0.64, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "110081856e79ce42b80ae0686ee1f5bf", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ba0070aa48a323c6960cd8494e304fc5340ab026", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 64, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance)	Élevée	Moyen · 56
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 56 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecr Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 174, "payload_entropy": 5.221904270852729, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 96, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 56, "tag_count": 4, "anomaly_count": 0, "campaign_key": "da6d80c070410cb4495640a6b637c3321044d329", "event_fingerprint": "da2c6a4d63975801acbe67a1928584b90b2b9d63", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "02d15236885f1a1d9389977cbab0b202", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "30398c6c5f61af3717712b4c0e3fb36e0ae5c2a8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance)", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /manage/account/login	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /manage/account/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /manage/account/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /manage/account/login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /manage/account/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://ww Requête brute (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "1d98e547275d79a259c88ab2179d7a5b45136091", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 194, "payload_entropy": 5.188765523538021, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 58, "tag_count": 5, "anomaly_count": 0, "campaign_key": "91516ee91249f9458ea5b0427e8bbe8848417b2b", "event_fingerprint": "414249dff9eb7684d2cccc3eff2f594c451cf3aa", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "7d06cc2822bd59bc7ad763f1af59112b", "path_pattern_hash": "c9092f743328565e59631a2a8c600c06" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "evidence": { "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a38171ea73ea56bfaab3883ebe728f85bcf146e", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login", "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /admin/index.html	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /admin/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /admin/index.html Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET ActiveMQ console Ligne de requête `GET /admin/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.no Requête brute (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "4b0fa2b11fff9aad6a33a18fa912997e85ee3d7a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 190, "payload_entropy": 5.229456103255936, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 59, "tag_count": 8, "anomaly_count": 0, "campaign_key": "c036e373b32fc955ffa418afe306ae46774d424b", "event_fingerprint": "35f3e33c9509aa32280e1f042155146c499db4e0", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "1ef4d71054e267f8904a521099f22ad7", "path_pattern_hash": "f654a37a97b7cd890ed6641ca011c363" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "evidence": { "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "95b77f2aafbb5f6dc7390dcdd8627173ed1db56f", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html", "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /index.html	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /index.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co Requête brute (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 184, "payload_entropy": 5.237632747372332, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "edc3063640302581a1483a9fd6bcc5f7ff16daad", "event_fingerprint": "80de69ff0952533ad9ad47fad1ae0248951ba91c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "35b3469e48381be61881e6b336386d55", "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "evidence": { "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c5a4a337c53cb0cc3e2b4a8a502975a57cffa643", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html", "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /+CSCOE+/logon.html	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /+CSCOE+/logon.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /+CSCOE+/logon.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /+CSCOE+/logon.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /+CSCOE+/logon.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www. Requête brute (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "2febb8a3c3d7f366eb236521e1eaa73748bc008b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 192, "payload_entropy": 5.278948081163126, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c42c18635b9785ce3072b1f0000cfa3977418e38", "event_fingerprint": "a7a1b52e53611dbd8a09dd1632cca94b52550126", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "f47a5912edc8a0308db6b6a3ecbcd9b3", "path_pattern_hash": "822b93c1de9180d86276e796ab5bb039" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "evidence": { "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "939c947570be66afe2a27627ce2382f03165bdd4", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html", "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /cgi-bin/login.cgi	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /cgi-bin/login.cgi UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/login.cgi TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /cgi-bin/login.cgi Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /cgi-bin/login.cgi HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.n Requête brute (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "cgi", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "4ed67956bf1afbdf7ecfacd9a5462fa4568ad191", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 191, "payload_entropy": 5.1953110418692905, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 0, "campaign_key": "c3a411359f61245e868ebd4a556804406b0d6a23", "event_fingerprint": "29bbb064702a1c8c296c721d16431b0ed8c81073", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "9a6701232784ea5de7f0f88fe4bfaf86", "path_pattern_hash": "0254f935cc3e30d1c750bc16ae1de8fe" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "evidence": { "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "04e108ca29125668a8e56691be62d2c69820fbd0", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi", "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint" ] }
25/07/2026 19:59:41 UTC	TCP	25461 · HTTP	http	Scan de ports port scan syn · via HTTP:25461 · (reconnaissance) · → /login.htm	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.htm UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /login.htm TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 25461 Chemin / cible /login.htm Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.htm HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:25461 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "htm", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "efbae3a375ddeee338c385b6b1bf75ac32d5c2b8", "http_target_hash": "a080cb0dd1e1d6f0c7467b3267535b1479975617", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.2149935531496565, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "edc3063640302581a1483a9fd6bcc5f7ff16daad", "event_fingerprint": "16158238132596a4f28a45078ed7c4916a0c4316", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "b856a5c882dce3fb4cb4c0a9ef3e4b28", "path_pattern_hash": "8d9104962905da3abf94ae1977aa5733" }, "target_context": { "dst_port": 25461, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10d8320f856045d851e5409fdc9f5db9bc0b5962", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 25461, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:25461 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm", "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:25461\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "25461 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:36 UTC	TCP	25461 · TLS	tls	Scan de ports port scan syn · via TLS:25461 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 7c1e207beb00684b Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 25461 Chemin / cible — Service TLS Payload ��r�YIb,T�Q��5duz��,;�}X��g k#��v�m�{,WT�G��JK��n&̨̩�/�0�+�,�� /5� � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��r�YIb,T�Q��5duz��,;�}X��g k#��v�m�{,WT�G��JK��n&̨̩�/�0�+�,�� /5� � Requête brute (extrait) ��r�YIb,T�Q��5duz��,;�}X��g k#��v�m�{,WT�G��JK��n&̨̩�/�0�+�,�� /5� � � http/1.1+ 3&$ $��+R�@�۟o��E��VC��^ Meta JSON brut { "tls_ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "tls_alpn": [ "http\/1.1" ], "bytes_in": 258, "payload_entropy": 5.896027460606066, "port_category": "registered", "org": "Scaleway SAS", "service": "tls", "app_proto": "tls", "asn": 12876, "country": "FR", "dst_port": 25461, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3699e019687e4e8f4567a7693887d6f38b1129c2", "event_fingerprint": "dc7f9717ccf5ed6bcc9781d35942e095c52cd3db", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "payload_hash": "a9d2983d3fa21f36c1b4fede2d3f4596", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 25461, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\u000f\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\u0003\u001e\ufffdg k#\u0006\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u0006m\ufffd{,\u000eWT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\u000f\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\u0003\u001e\ufffdg k#\u0006\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u0006m\ufffd{,\u000eWT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 $\ufffd\ufffd+R\ufffd@\ufffd\u06dfo\ufffd\u001c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000E\ufffd\ufffd\ufffdVC\ufffd\ufffd\u000f^", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\u000f\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\u0003\u001e\ufffdg k#\u0006\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u0006m\ufffd{,\u000eWT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dca6bb8e40127e1f70c970dd64e8a20680af689d", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\u000f\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\u0003\u001e\ufffdg k#\u0006\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u0006m\ufffd{,\u000eWT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "port": 25461, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\ufffdg k#\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdm\ufffd{,WT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:25461 \u00b7 (reconnaissance)", "target_port_label": "25461 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 25461, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\u000f\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\u0003\u001e\ufffdg k#\u0006\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u0006m\ufffd{,\u000eWT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "port": 25461, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:25461 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdYIb,T\ufffdQ\ufffd\ufffd\ufffd5duz\ufffd\ufffd,;\ufffd}X\ufffd\ufffd\ufffd\ufffdg k#\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdm\ufffd{,WT\ufffdG\ufffd\ufffd\ufffd\ufffdJK\ufffd\ufffd\ufffd\ufffdn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd", "target_port_label": "25461 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "25461" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
25/07/2026 19:59:30 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /admin/login.asp	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /admin/login.asp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/login.asp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /admin/login.asp Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET Probe /admin/login ActiveMQ console Ligne de requête `GET /admin/login.asp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nok Requête brute (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "asp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "74ee0e33710b439680e8c9dc84b7100d7e7738f2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 189, "payload_entropy": 5.183182830821568, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 60, "tag_count": 8, "anomaly_count": 0, "campaign_key": "0439610e913a5159be929af89844d07d4021ba41", "event_fingerprint": "158bce79ad8444965196efcdc490763105662690", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "Probe \/admin\/login", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "a0b59bca08437bdc12694dbe8848f3a7", "path_pattern_hash": "742c42cda425189da92779d492183288" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "evidence": { "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "63d964a99ec804d0209de7f0eb91e299b902743c", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp", "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path" ] }
25/07/2026 19:59:30 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /web/	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /web/ UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /web/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /web/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /web/ HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/geno Requête brute (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "be2a319b834b23bb5db3b9088093e167eb951dfe", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 178, "payload_entropy": 5.195643055147191, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 58, "tag_count": 4, "anomaly_count": 0, "campaign_key": "59b264af72240d1fbc8268d7369d3bf83cb3dd73", "event_fingerprint": "55c51ed0daa483d8b092a1ca5f47bd65617a78a4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "60e65c57995fd27b587d8e16e2dc30e8", "path_pattern_hash": "d10f26a614111c156a22417b020f287c" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "evidence": { "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "210c3be8ef0be8cc4b73df1bce3296c6e6bd40dd", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/", "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:30 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /webpages/login.html	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /webpages/login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /webpages/login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /webpages/login.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /webpages/login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www Requête brute (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "3557966eb4cf90eaeaf0c2c998dc2912f0a3d646", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 193, "payload_entropy": 5.185214012444915, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 58, "tag_count": 4, "anomaly_count": 0, "campaign_key": "59b264af72240d1fbc8268d7369d3bf83cb3dd73", "event_fingerprint": "6ebf3e3049367e59b2334ac2001179d0de0e0ba1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "06742e9bbaa13c00f14be65df3971e83", "path_pattern_hash": "048ac28c307da42b70c2a2400dc8fdcb" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "evidence": { "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e0e58a31bbbca8b9376eb0a44933c873902dffb8", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html", "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:30 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /favicon.ico	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50% Confiance classification 64% Corrélation +14 Risque capteur Moyen · 47 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE TA0043 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.c Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 185, "payload_entropy": 5.209692811759747, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c65db283152da297333990c5eaa4bec914f183e6", "event_fingerprint": "1ba7ea8bfb3859cd9a197dd5868e2c4a7d62d8ac", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.64, "classification_confidence": 0.64, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "4271dbcb1559bf2b17693c29eb5b5a14", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e873eed60aa62d02e1824ce0895a3cad97470ac2", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 64, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance)	Élevée	Moyen · 56
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 56 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecr Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 174, "payload_entropy": 5.198915765105602, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 96, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 56, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cef0ccc4ea9f5ea7f08e6eefa9dc78a1179f5c16", "event_fingerprint": "348ff17e2bd5fdf248c329f8861d7d89510227da", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "ded3670139b442b3b10e860fdbd80721", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "158e8a707c59ffea9b0115622264e994cb37ca62", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance)", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecr", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /manage/account/login	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /manage/account/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /manage/account/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /manage/account/login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /manage/account/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://ww Requête brute (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "1d98e547275d79a259c88ab2179d7a5b45136091", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 194, "payload_entropy": 5.16814696683699, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8f9bd1270debcce04d8b5a16e2ce1a6d7ea8b430", "event_fingerprint": "ab906b095cad3e22d3a10f06c4ba4d6c4e8a1961", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "3fba663ae7ddf9b8eacddaacb677916d", "path_pattern_hash": "c9092f743328565e59631a2a8c600c06" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "evidence": { "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cce5080163ab86eeb4d355fd1055d7bb12af194d", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login", "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/ww", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /admin/index.html	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /admin/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /admin/index.html Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET ActiveMQ console Ligne de requête `GET /admin/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.no Requête brute (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "4b0fa2b11fff9aad6a33a18fa912997e85ee3d7a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 190, "payload_entropy": 5.208403471676989, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 60, "tag_count": 8, "anomaly_count": 0, "campaign_key": "0439610e913a5159be929af89844d07d4021ba41", "event_fingerprint": "a1b200fce77e43f4dadb5435693d87d8d2dd483c", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "504d794936eaa97e7ca05b0ea022f09d", "path_pattern_hash": "f654a37a97b7cd890ed6641ca011c363" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "evidence": { "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2fdc79af29057478397101f44c959d228ce9bf7b", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html", "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /index.html	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /index.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co Requête brute (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 184, "payload_entropy": 5.2158936169375485, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c65db283152da297333990c5eaa4bec914f183e6", "event_fingerprint": "53a671012f36d4f7273a383751618eb76bbb0334", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "f2a2287283268bcf65ee74ea9a005859", "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "evidence": { "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "308f1aa950cc7c4234414dfa1cfb9fa242dfde0b", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html", "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /+CSCOE+/logon.html	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /+CSCOE+/logon.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /+CSCOE+/logon.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /+CSCOE+/logon.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /+CSCOE+/logon.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www. Requête brute (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "2febb8a3c3d7f366eb236521e1eaa73748bc008b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 192, "payload_entropy": 5.258114747829792, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 58, "tag_count": 4, "anomaly_count": 0, "campaign_key": "59b264af72240d1fbc8268d7369d3bf83cb3dd73", "event_fingerprint": "aed017e84e69274ce3a4bb1aedb0971ee19d5da1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "bae95ebb1d865d8090537fdec2b621af", "path_pattern_hash": "822b93c1de9180d86276e796ab5bb039" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "evidence": { "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f8928189a8a6beacc83955c3dfe77da3afa83c0e", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html", "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /cgi-bin/login.cgi	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /cgi-bin/login.cgi UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/login.cgi TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /cgi-bin/login.cgi Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /cgi-bin/login.cgi HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.n Requête brute (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "cgi", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "4ed67956bf1afbdf7ecfacd9a5462fa4568ad191", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 191, "payload_entropy": 5.174368633492327, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 0, "campaign_key": "3b79fbe8df407b574758171ec0b677847f23b054", "event_fingerprint": "ea4d673084185f314a6c9db668b56d5418253dfa", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "18150ec327fda8f5d6eddbf6518556d4", "path_pattern_hash": "0254f935cc3e30d1c750bc16ae1de8fe" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "evidence": { "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd7e47bc855d550759e57c986211d6020cc5b1bb", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi", "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /login.htm	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.htm UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /login.htm TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /login.htm Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.htm HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "htm", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "a080cb0dd1e1d6f0c7467b3267535b1479975617", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.19313562965239, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c65db283152da297333990c5eaa4bec914f183e6", "event_fingerprint": "b4e260a481466ff326b13540f0e523fd96920a6f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "e1c0c5d77f93d69864c5fca82cbf8b4f", "path_pattern_hash": "8d9104962905da3abf94ae1977aa5733" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8c63a9dacfcea047435efa95ca29772a97e5b39f", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm", "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /login.html	Élevée	Moyen · 52
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /login.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 52 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co Requête brute (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "58165cf539b8f3baebb7b0688b61c0c6bd9c1221", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 184, "payload_entropy": 5.191111088504468, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c65db283152da297333990c5eaa4bec914f183e6", "event_fingerprint": "3f2d6965cdde10dea9f698167b21576f4404c843", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "2ab59bab9ef7d6c7d7463e104bd84933", "path_pattern_hash": "4bd05a9ef933daa96fd6cd3e76e0cd59" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "evidence": { "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0552b8a743154b2b0ce871b107abef2adfd949d", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html", "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /login.jsp	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.jsp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /login.jsp Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 53 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.jsp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "jsp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "b41f25730b5d6fa1c33072bb9c8d43aa7ba33e8e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.208506717042044, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5f75bca7c8d7343a311c5ebf7c430740a061ddbd", "event_fingerprint": "c4e557cc159c360c7cc90289572fd1c70d35d96a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "ab200c9e5114f3774111d5062905791e", "path_pattern_hash": "b16b806d2fba9e3fd94bdb22d055d68f" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5016956de2e0fa7dc3f674d160224a337cabf484", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp", "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /login	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 53 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/gen Requête brute (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 179, "payload_entropy": 5.190286340691193, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "5f75bca7c8d7343a311c5ebf7c430740a061ddbd", "event_fingerprint": "392d4a5d3e5b85f2e440515b1016c563dea36548", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "0efa190fc90e8cc0e79e80a9856b4eb7", "path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "evidence": { "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0c65f31daff19cd3040ac1ec766d559c393dc9fe", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/login", "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/gen", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /doc/index.html	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /doc/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /doc/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /doc/index.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /doc/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.noki Requête brute (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "94cbd295967620830d1ac8eefc3dab9ec7f6dbc6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 188, "payload_entropy": 5.206482139258698, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 58, "tag_count": 4, "anomaly_count": 0, "campaign_key": "59b264af72240d1fbc8268d7369d3bf83cb3dd73", "event_fingerprint": "430ee1f568f7b1ef6aea9efafe175e37445cfda3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "8bbec334a4657980de6e8c650ca7637a", "path_pattern_hash": "a7598671652528e5b3f1e930e03e0a00" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "evidence": { "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "54a349fd8fadec8e83cb0df7ac22bf12b558998f", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html", "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ] }
25/07/2026 19:59:29 UTC	TCP	17000 · HTTP	http	Scan de ports port scan syn · via HTTP:17000 · (reconnaissance) · → /remote/login	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /remote/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /remote/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17000 Chemin / cible /remote/login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) CVE-2024-21762 FortiOS MITRE T1210 remote svc LFI Double-dot bypass Ligne de requête `GET /remote/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia. Requête brute (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:17000 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "66d411451703f754ec5e27aff59f5e2db92f7050", "http_target_hash": "907a2da0c21f11374cb55d43385e76e234aedbef", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 186, "payload_entropy": 5.164581880053198, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5db65aeb8db02dc58c86bd37d73577754127e41e", "event_fingerprint": "f5f142c054b8e0ca52685ec368e7fc25a6ecb41e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0721", "pat-0803", "pat-0103" ], "matched_pattern_names": [ "CVE-2024-21762 FortiOS", "MITRE T1210 remote svc", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0721", "pat-0803", "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "1a25c71970723505362a0ce1cccc40a1", "path_pattern_hash": "3e486ce7203b6fa4cdeca113b89969b2" }, "target_context": { "dst_port": 17000, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "evidence": { "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "19709c3dcc65bb8cdfd8d740c2ba35a755e7c5f9", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 17000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:17000 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login", "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:17000\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.", "target_port_label": "17000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_vpn_portal_scan" ] }
25/07/2026 19:59:24 UTC	TCP	17000 · TLS	tls	Scan de ports port scan syn · via TLS:17000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 7c1e207beb00684b Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17000 Chemin / cible — Service TLS Payload ��0�p@�L7}��. &�0�d�+\��w�� 9w��մ��G��[�7&̨̩�/�0�+�,�� /5� � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��0�p@�L7}��.&�0�d�+\��w�� 9w��մ��G��[�7&̨̩�/�0�+�,�� /5� � Requête brute (extrait) ��0�p@�L7}��. &�0�d�+\��w�� 9w��մ��G��[�7&̨̩�/�0�+�,�� /5� � � http/1.1+ 3&$ ɜJ��"��.EQ?�&d8�8S!�-ι�� Meta JSON brut { "tls_ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "tls_alpn": [ "http\/1.1" ], "bytes_in": 258, "payload_entropy": 5.85751525852382, "port_category": "registered", "org": "Scaleway SAS", "service": "tls", "app_proto": "tls", "asn": 12876, "country": "FR", "dst_port": 17000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1c01a1222945fe899e668752f7de08a96b565eeb", "event_fingerprint": "5b63249a8e05058cfaad3e0a974a528bc20e7d8c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "payload_hash": "eecba29f428ae0687552067520692e92", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 17000, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd0\ufffdp@\u0014\ufffdL7}\ufffd\ufffd.\f&\ufffd0\ufffdd\ufffd+\\\u0000\ufffd\b\ufffdw\u000f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00029w\ufffd\ufffd\u0574\ufffd\ufffd\ufffd\u001bG\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd[\ufffd7\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd0\ufffdp@\u0014\ufffdL7}\ufffd\ufffd.\f&\ufffd0\ufffdd\ufffd+\\\u0000\ufffd\b\ufffdw\u000f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00029w\ufffd\ufffd\u0574\ufffd\ufffd\ufffd\u001bG\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd[\ufffd7\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u025cJ\ufffd\ufffd\"\ufffd\ufffd\ufffd.EQ?\ufffd&d8\ufffd8S!\u0012\ufffd\u0005\u000e-\u03b9\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd0\ufffdp@\u0014\ufffdL7}\ufffd\ufffd.\f&\ufffd0\ufffdd\ufffd+\\\u0000\ufffd\b\ufffdw\u000f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00029w\ufffd\ufffd\u0574\ufffd\ufffd\ufffd\u001bG\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd[\ufffd7\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a97871d245daad906fbb7c04c8c9632f6c6135c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd0\ufffdp@\u0014\ufffdL7}\ufffd\ufffd.\f&\ufffd0\ufffdd\ufffd+\\\u0000\ufffd\b\ufffdw\u000f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00029w\ufffd\ufffd\u0574\ufffd\ufffd\ufffd\u001bG\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd[\ufffd7\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "port": 17000, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd0\ufffdp@\ufffdL7}\ufffd\ufffd.&\ufffd0\ufffdd\ufffd+\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9w\ufffd\ufffd\u0574\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd7&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:17000 \u00b7 (reconnaissance)", "target_port_label": "17000 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 17000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd0\ufffdp@\u0014\ufffdL7}\ufffd\ufffd.\f&\ufffd0\ufffdd\ufffd+\\\u0000\ufffd\b\ufffdw\u000f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00029w\ufffd\ufffd\u0574\ufffd\ufffd\ufffd\u001bG\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd[\ufffd7\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "port": 17000, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:17000 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd0\ufffdp@\ufffdL7}\ufffd\ufffd.&\ufffd0\ufffdd\ufffd+\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9w\ufffd\ufffd\u0574\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd7&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd", "target_port_label": "17000 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "17000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 17000, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
25/07/2026 19:59:08 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /web/	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /web/ UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /web/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /web/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /web/ HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genom Requête brute (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "be2a319b834b23bb5db3b9088093e167eb951dfe", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 177, "payload_entropy": 5.208531612818487, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "89dd98e66c4d7eadac13b8dbaa23fb5c77b891df", "event_fingerprint": "bf47a98e9257fc84ff7f7359bcf712f3aa594a0b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "3c4903a6a9ea3200f6c2dc78dfafb705", "path_pattern_hash": "d10f26a614111c156a22417b020f287c" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "evidence": { "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d22b35317125355d54aba43bad5dfe56fb1ca5fd", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/", "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:08 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /webpages/login.html	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /webpages/login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /webpages/login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /webpages/login.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /webpages/login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www. Requête brute (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "3557966eb4cf90eaeaf0c2c998dc2912f0a3d646", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 192, "payload_entropy": 5.196431751810375, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "89dd98e66c4d7eadac13b8dbaa23fb5c77b891df", "event_fingerprint": "309248e36ff2277fa938d528246bbf4ca3bc139d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "de62d859fc77b702a407c5206c9d7c01", "path_pattern_hash": "048ac28c307da42b70c2a2400dc8fdcb" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "evidence": { "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd4b96fe5cef99acaebd3dfc01849c397926448e", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html", "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:08 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /favicon.ico	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50% Confiance classification 64% Corrélation +14 Risque capteur Moyen · 48 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE TA0043 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 184, "payload_entropy": 5.2218641298615545, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 48, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f95bf8985c929927eee7ee35e156c23a577f6f86", "event_fingerprint": "a5b786df55f1f9acbcba9d7e11f98285e5884f28", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.64, "classification_confidence": 0.64, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 48, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "12d322891ce58c3581c9d714c5f71e69", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59738c46ca7bc9458db191edfb5e28080ecd8d5c", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 64, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 48, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecra Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 173, "payload_entropy": 5.212311319259246, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 96, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5f84df0aca254054b5878b2d5fdc3fd2670b86a6", "event_fingerprint": "906f1a22246ebd3b1cd8149d664904d0238db0a8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "1849b3c297ddcf174ccca1aa0d11fb2c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6fdac4ffc6ee166147ecfbbdb0402110d8f7a6b6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance)", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /manage/account/login	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /manage/account/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /manage/account/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /manage/account/login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /manage/account/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www Requête brute (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "1d98e547275d79a259c88ab2179d7a5b45136091", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 193, "payload_entropy": 5.179179421631153, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "b96ae619046e76976eb246a1fb2b3afc81ca5977", "event_fingerprint": "97709baecca8f6606fdc55958edbc0ff868518b3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "50ab2044008c9f337254d31cf720b3ea", "path_pattern_hash": "c9092f743328565e59631a2a8c600c06" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "evidence": { "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e29b79442d0f1d08f1fa3f9394d88e9923b6c8e6", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login", "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /admin/index.html	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /admin/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /admin/index.html Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET ActiveMQ console Ligne de requête `GET /admin/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nok Requête brute (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "4b0fa2b11fff9aad6a33a18fa912997e85ee3d7a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 189, "payload_entropy": 5.22004186356365, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 60, "tag_count": 9, "anomaly_count": 0, "campaign_key": "20760d7be280bffe0b8103693a88766005dbde54", "event_fingerprint": "b053b2b6c80fc2f97c378cb150ab778708aecce6", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "869fbdbb55446a736d770a0ddddc3d5d", "path_pattern_hash": "f654a37a97b7cd890ed6641ca011c363" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "evidence": { "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "79c9906d08488b8cd4fc69ba42d4e6f1e9db1d86", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html", "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /index.html	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /index.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 53 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.228208174907092, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f95bf8985c929927eee7ee35e156c23a577f6f86", "event_fingerprint": "6dba00dcee6c150b4a8b9e2af2ebdb5ecb0b008f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "4e78884d749016c4f74a028dd06b5d89", "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1e0c9cf34901c9917f0bc6cb96021bf48d453098", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html", "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /+CSCOE+/logon.html	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /+CSCOE+/logon.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /+CSCOE+/logon.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /+CSCOE+/logon.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /+CSCOE+/logon.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.n Requête brute (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "2febb8a3c3d7f366eb236521e1eaa73748bc008b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 191, "payload_entropy": 5.26981223874181, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "89dd98e66c4d7eadac13b8dbaa23fb5c77b891df", "event_fingerprint": "6ec929021037320e8ef35222459a884f9a4c4d6d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "6da3bd02dd14e5ad7ad713e2908ece61", "path_pattern_hash": "822b93c1de9180d86276e796ab5bb039" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "evidence": { "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "02cd3e7c6c93c3691948a15c4e9732e057995c59", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html", "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /cgi-bin/login.cgi	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /cgi-bin/login.cgi UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/login.cgi TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /cgi-bin/login.cgi Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /cgi-bin/login.cgi HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.no Requête brute (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "cgi", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "4ed67956bf1afbdf7ecfacd9a5462fa4568ad191", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 190, "payload_entropy": 5.185726675921509, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 60, "tag_count": 8, "anomaly_count": 0, "campaign_key": "4a9fa87de5adef65ce0001f380a1093e37c19389", "event_fingerprint": "da19016a9acef4ea277af6f371e056721b07f7d9", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "1838254b92131e64c43fb8107a545b60", "path_pattern_hash": "0254f935cc3e30d1c750bc16ae1de8fe" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "evidence": { "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b5234d5613080fb5e4b0605fb24e0e03d8a08d0a", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi", "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /login.htm	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.htm UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /login.htm TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /login.htm Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 53 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.htm HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/ Requête brute (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "htm", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "a080cb0dd1e1d6f0c7467b3267535b1479975617", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 182, "payload_entropy": 5.205436122728411, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f95bf8985c929927eee7ee35e156c23a577f6f86", "event_fingerprint": "311bac264daeaeb54145858c0be7243c1b10b42e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "5526191f7c4ef1d651e954a58d503e1d", "path_pattern_hash": "8d9104962905da3abf94ae1977aa5733" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "evidence": { "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a12ca6c3ba1883b1e389dcb08ea09f9f2f84013", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm", "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /login.html	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /login.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 53 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "58165cf539b8f3baebb7b0688b61c0c6bd9c1221", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.203290222821372, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f95bf8985c929927eee7ee35e156c23a577f6f86", "event_fingerprint": "ec49ea0d6807c0978ebe1f923e70c1ea9b08f669", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "5b9d3be22819f5a8f51f8938edd51426", "path_pattern_hash": "4bd05a9ef933daa96fd6cd3e76e0cd59" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "196e9f19e38eb627dd3a1a86b144990b121ee326", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 53, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html", "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /login.jsp	Élevée	Moyen · 54
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login.jsp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /login.jsp Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 54 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.jsp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/ Requête brute (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "jsp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "b41f25730b5d6fa1c33072bb9c8d43aa7ba33e8e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 182, "payload_entropy": 5.220891666642185, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 54, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8524a1769d842c312c038436820913b89ef74416", "event_fingerprint": "8a2c448d55657d63ac51d0748f56e141e8719174", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 54, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "14bb66a39af8579aecaf0a505b7db307", "path_pattern_hash": "b16b806d2fba9e3fd94bdb22d055d68f" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "evidence": { "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c7c5f85908aa08755f2adf53b9cfc2e026804596", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 54, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp", "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /login	Élevée	Moyen · 54
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 54 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/geno Requête brute (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 178, "payload_entropy": 5.203026862727193, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 54, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8524a1769d842c312c038436820913b89ef74416", "event_fingerprint": "6bbedc5a453f43f03c5823a0d95566dfe104562c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 54, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "7213eb3e0f76ab5bfee810d8d5822454", "path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "evidence": { "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e77a82bf1c6920979398ef0e84ce23839443a24e", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 54, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/login", "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 3 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /doc/index.html	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /doc/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /doc/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /doc/index.html Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /doc/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia Requête brute (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "94cbd295967620830d1ac8eefc3dab9ec7f6dbc6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 187, "payload_entropy": 5.218316588578756, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "89dd98e66c4d7eadac13b8dbaa23fb5c77b891df", "event_fingerprint": "7d4bf69a7934ab66091d75f8dab05fb41b0f01ef", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "9b84eb7def13d2c5e75da546a9cc38fd", "path_pattern_hash": "a7598671652528e5b3f1e930e03e0a00" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "evidence": { "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a7a79c20c5f0c5eec4e7c8af79d4b5d5d503a0d", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html", "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /remote/login	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /remote/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /remote/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /remote/login Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) CVE-2024-21762 FortiOS MITRE T1210 remote svc LFI Double-dot bypass Ligne de requête `GET /remote/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.c Requête brute (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "907a2da0c21f11374cb55d43385e76e234aedbef", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 185, "payload_entropy": 5.176401410915235, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "86e6cc482a3f97554fdb3d68ed19e87a8da67347", "event_fingerprint": "7b80f0762d91079ab8cf3dab041f01c63c321d3b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0721", "pat-0803", "pat-0103" ], "matched_pattern_names": [ "CVE-2024-21762 FortiOS", "MITRE T1210 remote svc", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0721", "pat-0803", "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "80266d4a7b86a45943c52c887522b089", "path_pattern_hash": "3e486ce7203b6fa4cdeca113b89969b2" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "evidence": { "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df8e49bc444d7ede9860917b652a09407b989a45", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login", "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_vpn_portal_scan", "net_web_probe" ] }
25/07/2026 19:59:07 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → /admin/login.asp	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /admin/login.asp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/login.asp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible /admin/login.asp Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET Probe /admin/login ActiveMQ console Ligne de requête `GET /admin/login.asp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.noki Requête brute (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:8880 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "asp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d", "http_target_hash": "74ee0e33710b439680e8c9dc84b7100d7e7738f2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 188, "payload_entropy": 5.194789579589839, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8880, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 60, "tag_count": 9, "anomaly_count": 0, "campaign_key": "20760d7be280bffe0b8103693a88766005dbde54", "event_fingerprint": "a0edbc8a89093b76bacc28403313d0c04ce4745c", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "Probe \/admin\/login", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "77e81dc6dc34761e12d162192093a715", "path_pattern_hash": "742c42cda425189da92779d492183288" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "evidence": { "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0600282ed718ea83e0a5894132729b4423083c31", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp", "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 22, 23, 81, 85, 554, 8880, 25461 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "http", "http-alt-81", "http-alt-8880", "port:17000", "port:25461", "rtsp", "ssh", "telnet" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path", "net_web_probe" ] }

62.210.142.165

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence