|
|
TCP |
12198
|
—
|
Sonde Kafka
kafka probe · port 12198 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12198
Chemin / cible
—
Payload
߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 542,
"payload_entropy": 4.161650730260368,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 12198,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "aef4e858509f2b7ee50ef7a531dfe5ada5a7d029",
"event_fingerprint": "06debb40e36dd4bb39307c08f5a4ca2b13c78831",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4509eec7340acca41e94bc6bae32c197",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 12198,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "176f170d596e2e1de69dc480b61311aa358b8dc8",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 12198
},
"evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 12198 \u00b7 (sonde \/ probe)",
"target_port_label": "12198",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 12198,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 12198
},
"attack_vector": "kafka probe \u00b7 port 12198 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "12198",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12198"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
943
|
—
|
Sonde Kafka
kafka probe · port 943 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
943
Chemin / cible
—
Payload
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 520,
"payload_entropy": 3.999375592941219,
"port_category": "well_known",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 943,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0453cdcee1c6d1c192a5240e416a74eaa62029d4",
"event_fingerprint": "1676cad7f67d069871152a1ad84ef6ffe4a11e15",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3406a76f136d489bc5c37b989c06ec84",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 943,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af1b50d6fe5eddfdccbe79754220ad3c2358cd93",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 943
},
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 943 \u00b7 (sonde \/ probe)",
"target_port_label": "943",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 943,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 943
},
"attack_vector": "kafka probe \u00b7 port 943 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "943",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "943"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8143 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8143 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
Cible HTTP
—
TLS SNI
ip-62-3-50-33.v4.isp.servpersosystems.net
Capteur
paris-1
|
Méthode
—
Port
8143
Chemin / cible
—
Service
TLS
SNI TLS
ip-62-3-50-33.v4.isp.servpersosystems.net
Payload
� �4��U�bC����=��� ��5;���_���7Z /��X��&�2�o? �_�T�ʕ�J��R.� �+�/�,�0̨̩� �� � � . , )ip-62-3-50-
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4��U�bC����=��� ��5;���_���7Z /��X��&�2�o? �_�T�ʕ�J��R.� �+�/�,�0̨̩� ��
� � . , )ip-62-3-50-
Requête brute (extrait)
� �4��U�bC����=��� ��5;���_���7Z /��X��&�2�o? �_�T�ʕ�J��R.� �+�/�,�0̨̩� �� � � . , )ip-62-3-50-33.v4.isp.servpersosystems.net � � 2
Meta JSON brut
{
"tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"bytes_in": 1533,
"payload_entropy": 7.731719267142996,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8143,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "079897024c604039fadcbc9c00b6236ce841426c",
"event_fingerprint": "b58a9231fb9a8cc6cd05daa83c32a0a385f4aa65",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "20b279993ae2e137e62b9647c6d768fb",
"payload_hash": "dd9d430d265bf583aa67e14cdc4dd6a5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net"
},
"target_context": {
"dst_port": 8143,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "def5027b7eb80cf3cc45ac3af850b85dac11222b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 8143,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd4\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\u058c7Z \/\ufffd\ufffdX\ufffd\ufffd&\ufffd2\ufffdo?\ufffd_\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-",
"attack_vector": "postgres probe \u00b7 via TLS:8143 \u00b7 (sonde \/ probe)",
"target_port_label": "8143 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8143,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 8143,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8143 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd4\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\u058c7Z \/\ufffd\ufffdX\ufffd\ufffd&\ufffd2\ufffdo?\ufffd_\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-",
"target_port_label": "8143 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8143"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3"
]
}
|
|
|
TCP |
3071 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:3071 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 3642a49605ec090c SNI ip-62-3-50-33.v4.isp.servpersosystems.net
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
ip-62-3-50-33.v4.isp.servpersosystems.net
Capteur
paris-1
|
Méthode
—
Port
3071
Chemin / cible
—
Service
TLS
SNI TLS
ip-62-3-50-33.v4.isp.servpersosystems.net
Payload
� �U � $�L3�hc7 Ŧ��͒z�_T8� �/��+ԃC�|�n9������q���)N1 ���+�/�,�0̨̩�� � � / 5 ��� � � f
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �U � $�L3�hc7
Ŧ��͒z�_T8� �/��+ԃC�|�n9������q���)N1 ���+�/�,�0̨̩�� � � / 5 ��� �
� f
Requête brute (extrait)
� �U � $�L3�hc7 Ŧ��͒z�_T8� �/��+ԃC�|�n9������q���)N1 ���+�/�,�0̨̩�� � � / 5 ��� � � f uD���H�p���ڷl�N�7�/��q���B�Z ��)�7Hr�낅M c���r���|z"�'�;���Q� K�RQQ���ס_")�a��9� �����Qў�/!��Z�-�S#�4����
Meta JSON brut
{
"tls_ja3_hash": "3642a49605ec090cad5d943bbe79400d",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 529,
"payload_entropy": 6.804088443174939,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 3071,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ab1c13e93cf7758e522da7b6e5a37295a67dd3f4",
"event_fingerprint": "57bea3f328a5ec0a0b9f192506ddc6b84c313b33",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3642a49605ec090cad5d943bbe79400d",
"payload_hash": "7e0af877156e0c910d0ed76d56fca118",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net"
},
"target_context": {
"dst_port": 3071,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f\u0000 uD\ufffd\ufffd\ufffdH\ufffdp\ufffd\ufffd\u0005\u0006\ufffd\u06b7l\ufffdN\ufffd7\ufffd\/\ufffd\ufffdq\ufffd\ufffd\ufffdB\ufffdZ\u0000\ufffd\ufffd)\ufffd7Hr\ufffd\ub085M\u0000c\ufffd\u0014\u0013\ufffd\ufffdr\ufffd\ufffd\ufffd|z\"\ufffd'\ufffd;\ufffd\ufffd\ufffdQ\ufffd\u000bK\u0011\ufffdRQQ\u0011\u0003\ufffd\ufffd\u0015\ufffd\u05e1_\")\ufffda\ufffd\ufffd9\ufffd\n\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\u000eQ\u045e\ufffd\/!\ufffd\ufffd\u0012\u000fZ\ufffd\u0007-\ufffdS#\ufffd4\ufffd\ufffd\ufffd\ufffd\u001a",
"payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc5e62705a70795a003953062842e9522196b7a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f",
"tls_ja3": "3642a49605ec090cad5d943bbe79400d",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 3071,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd \ufffdU\ufffd$\ufffdL3\ufffdhc7\r\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\r\ufffdf",
"attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)",
"target_port_label": "3071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3071,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f",
"tls_ja3": "3642a49605ec090cad5d943bbe79400d",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 3071,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd \ufffdU\ufffd$\ufffdL3\ufffdhc7\r\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd|\ufffdn9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\r\ufffdf",
"target_port_label": "3071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3071 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:3071 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 2b91617a55f2a4d9 SNI www.blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
www.blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
3071
Chemin / cible
—
Service
TLS
SNI TLS
www.blacklistip.com
Payload
6 2�N�=*|���47� ^�"���k8<�`�bG�5 8�x�cd���x��(����� Ͻ���� ���+�/�,�0̨̩�� � � / 5 ɚ�
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0607
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
6 2�N�=*|���47� ^�"���k8<�`�bG�5 8�x�cd���x��(����� Ͻ���� ���+�/�,�0̨̩�� � � / 5 ɚ�
Requête brute (extrait)
6 2�N�=*|���47� ^�"���k8<�`�bG�5 8�x�cd���x��(����� Ͻ���� ���+�/�,�0̨̩�� � � / 5 ɚ� + �� # Di h2 - h2http/1.1 3 + )�� ���h��O �[B��NzR� ��|^Y'2E0
Meta JSON brut
{
"tls_ja3_hash": "2b91617a55f2a4d9fb5e0ae71f7872c3",
"tls_sni": "www.blacklistip.com",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 571,
"payload_entropy": 6.915852047315395,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 3071,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ab1c13e93cf7758e522da7b6e5a37295a67dd3f4",
"event_fingerprint": "5fdba2b75c7f625d9f7557a52d7f73fe07faee50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0607"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2b91617a55f2a4d9fb5e0ae71f7872c3",
"payload_hash": "5799f54e99c2c96f3659964b39e182b2",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "www.blacklistip.com"
},
"target_context": {
"dst_port": 3071,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=*|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=*|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\u0000+\u0000\u0007\u0006\n\n\u0003\u0004\u0003\u0003\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \b\u001f\ufffd\ufffd\ufffdh\u0019\ufffd\ufffdO\n\ufffd[B\ufffd\ufffdNzR\u001b\ufffd\t\ufffd\ufffd\u0016|^Y'2E0\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=*|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945078da234667feab855a94675eacc113b87b85",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=*|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000",
"tls_ja3": "2b91617a55f2a4d9fb5e0ae71f7872c3",
"tls_sni": "www.blacklistip.com",
"port": 3071,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "62\ufffdN\ufffd=*|\ufffd\ufffd\ufffd47\ufffd^\ufffd\"\ufffd\ufffd\ufffdk8<\ufffd`\ufffdbG\ufffd5 8\ufffdx\ufffdcd\ufffd\ufffd\ufffdx\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u03fd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u025a\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)",
"target_port_label": "3071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 3071,
"protocol_emulated": null,
"tags_summary": [
"pat-0607"
],
"tags_summary_labels_fr": [
"pat-0607"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=*|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000",
"tls_ja3": "2b91617a55f2a4d9fb5e0ae71f7872c3",
"tls_sni": "www.blacklistip.com",
"port": 3071,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)",
"evidence_snippet": "62\ufffdN\ufffd=*|\ufffd\ufffd\ufffd47\ufffd^\ufffd\"\ufffd\ufffd\ufffdk8<\ufffd`\ufffdbG\ufffd5 8\ufffdx\ufffdcd\ufffd\ufffd\ufffdx\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u03fd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u025a\ufffd",
"target_port_label": "3071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "3071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8808 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8808 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 20b279993ae2e137 SNI blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
Cible HTTP
—
TLS SNI
blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
8808
Chemin / cible
—
Service
TLS
SNI TLS
blacklistip.com
Payload
� ���j蠳`p T��[w���h�gG�E߳c�� � �>h�0�����JW��Wۼ����Bq%���� �+�/�,�0̨̩� �� � w blacklistip
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���j蠳`p T��[w���h�gG�E߳c�� � �>h�0�����JW��Wۼ����Bq%���� �+�/�,�0̨̩� ��
� w blacklistip
Requête brute (extrait)
� ���j蠳`p T��[w���h�gG�E߳c�� � �>h�0�����JW��Wۼ����Bq%���� �+�/�,�0̨̩� �� � w blacklistip.com � � 2 + 3����%
Meta JSON brut
{
"tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"bytes_in": 1507,
"payload_entropy": 7.762168345170723,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8808,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0a9b3f93937ad2bc2685dfc8264a894eef59e224",
"event_fingerprint": "e32d7cf82b56bd1ef234d96dc6ee737ce0518bf6",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "20b279993ae2e137e62b9647c6d768fb",
"payload_hash": "322254b37cfe1732d64d4b9343d80700",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "blacklistip.com"
},
"target_context": {
"dst_port": 8808,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd%",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "24a1e08f6f962fc5cdda59636047c170bd2d2091",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"port": 8808,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdj\u8833`pT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffdBq%\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
"attack_vector": "postgres probe \u00b7 via TLS:8808 \u00b7 (sonde \/ probe)",
"target_port_label": "8808 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8808,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"port": 8808,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8808 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdj\u8833`pT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffdBq%\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
"target_port_label": "8808 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8808"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3"
]
}
|
|
|
TCP |
447
|
—
|
Sonde Kafka
kafka probe · port 447 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
447
Chemin / cible
—
Payload
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 520,
"payload_entropy": 3.999375592941219,
"port_category": "well_known",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 447,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "bd5c6c79a9415e74772a5e57dad5d82a369b1eb2",
"event_fingerprint": "4c135145fafbf794098e2e2cdbdaee0e6274f4cf",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3406a76f136d489bc5c37b989c06ec84",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 447,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "393d4a3c5752fb30ff1a6388111358e7b72e89de",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 447
},
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 447 \u00b7 (sonde \/ probe)",
"target_port_label": "447",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 447,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 447
},
"attack_vector": "kafka probe \u00b7 port 447 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "447",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "447"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
2078
|
—
|
Sonde Kafka
kafka probe · port 2078 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2078
Chemin / cible
—
Payload
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 501,
"payload_entropy": 3.7940870380940184,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 2078,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1950897cdf5c623ca137b6961ae3e9ab8073e242",
"event_fingerprint": "fe4076eb8064813c8708b6e0d01947d5de16950c",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29b5329f45e73a6677bca0caf0ca278c",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 2078,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d93edb71d703d7381fcd9d5404e341d347518513",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 2078
},
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 2078 \u00b7 (sonde \/ probe)",
"target_port_label": "2078",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 2078,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 2078
},
"attack_vector": "kafka probe \u00b7 port 2078 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "2078",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2078"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5800 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5800 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c2b3f295508ddeaa
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5800
Chemin / cible
—
Service
TLS
Payload
� ��AR�g^��� ^�[lZ�4�*Th[�[ �F� b��Ox�߄������W���H��ă � ���+�/�,�0̨̩�� � � / 5 ��� - +
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��AR�g^��� ^�[lZ�4�*Th[�[ �F� b��Ox�߄������W���H��ă � ���+�/�,�0̨̩�� � � / 5 ��� - +
Requête brute (extrait)
� ��AR�g^��� ^�[lZ�4�*Th[�[ �F� b��Ox�߄������W���H��ă � ���+�/�,�0̨̩�� � � / 5 ��� - + �� Di h2 h2http/1.1 3 + ):: 2$|����#�XZ�"` ��Qhǫ�-Y �X���z� � � ��Uf�X���_�ZTڕ
Meta JSON brut
{
"tls_ja3_hash": "c2b3f295508ddeaa87216e60537ebcb9",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 511,
"payload_entropy": 6.886452515970853,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 5800,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "44009d2a7fd67acff0b8dc318ddf3708ce368967",
"event_fingerprint": "b8ab7aff2b405c5e820ad933f89c22005667e0f6",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c2b3f295508ddeaa87216e60537ebcb9",
"payload_hash": "0333c1d637920215cd0b8193422e8850",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5800,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffd*Th\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffd*Th\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u0000\u001b\u0000\u0003\u0002\u0000\u0002Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u00003\u0000+\u0000)::\u0000\u0001\u0000\u0000\u001d\u0000 2$|\ufffd\ufffd\ufffd\ufffd#\ufffdXZ\ufffd\"`\u001e\ufffd\ufffd\u0006Qh\u01eb\ufffd-Y\u001f\ufffdX\ufffd\ufffd\ufffdz\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffdUf\ufffdX\ufffd\ufffd\ufffd_\ufffdZT\u0695",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffd*Th\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79ba7e24aec58b3f2c38cd117d0ad8d5e352173e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffd*Th\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007",
"tls_ja3": "c2b3f295508ddeaa87216e60537ebcb9",
"port": 5800,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdAR\ufffdg^\ufffd\ufffd\ufffd^\ufffd[lZ\ufffd4\ufffd*Th[\ufffd[ \ufffdF\ufffdb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\ufffd\u0103 \ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-+",
"attack_vector": "tls probe \u00b7 via TLS:5800 \u00b7 (sonde \/ probe)",
"target_port_label": "5800 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5800,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffd*Th\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007",
"tls_ja3": "c2b3f295508ddeaa87216e60537ebcb9",
"port": 5800,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5800 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdAR\ufffdg^\ufffd\ufffd\ufffd^\ufffd[lZ\ufffd4\ufffd*Th[\ufffd[ \ufffdF\ufffdb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\ufffd\u0103 \ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-+",
"target_port_label": "5800 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5800"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:5800",
"port:8882",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5800
|
—
|
Sonde Kafka
kafka probe · port 5800 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5800
Chemin / cible
—
Payload
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
55%
Corrélation +8
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 516,
"payload_entropy": 3.9791255536617784,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 5800,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5c67bb6434a94dc920e707aa0b53ca870b0346bb",
"event_fingerprint": "378a38e20b012996744d4458dfc435e9ec8050c5",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 5800,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "957d404d7912d624c1c472b58d18699fc558774e",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 5800
},
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 5800 \u00b7 (sonde \/ probe)",
"target_port_label": "5800",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 5800,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 5800
},
"attack_vector": "kafka probe \u00b7 port 5800 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "5800",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5800"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:5800",
"port:8882",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8882 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:8882 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 5ff4aa95b2562d2b SNI ip-62-3-50-33.v4.isp.servpersosystems.net
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
ip-62-3-50-33.v4.isp.servpersosystems.net
Capteur
paris-1
|
Méthode
—
Port
8882
Chemin / cible
—
Service
TLS
SNI TLS
ip-62-3-50-33.v4.isp.servpersosystems.net
Payload
n�;"�7xz��S� � 2�n*��\�ЗkP� Z(��͊X�I]�z�!A�J�^;$sʑ�MN� ���+�/�,�0̨̩�� � � / 5 ��� �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
n�;"�7xz��S� � 2�n*��\�ЗkP� Z(��͊X�I]�z�!A�J�^;$sʑ�MN� ���+�/�,�0̨̩�� � � / 5 ��� �
Requête brute (extrait)
n�;"�7xz��S� � 2�n*��\�ЗkP� Z(��͊X�I]�z�!A�J�^;$sʑ�MN� ���+�/�,�0̨̩�� � � / 5 ��� � � � � ]�]�m^z T]"� ��E4��?�p�6C�b ���Z �D��ia |� ї7�Ue�>����J�TP fzu�Q�����I���-r�{l����]@��*W��ژ�o+\7
Meta JSON brut
{
"tls_ja3_hash": "5ff4aa95b2562d2b77b93af794413476",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 529,
"payload_entropy": 6.743476171705565,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8882,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "d15fe25aec83d1f1fa21d8f8d2f5f0168f12cb7b",
"event_fingerprint": "891f6ac1a9dc2799fbc2ab3a01fcd4caa9065c08",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "5ff4aa95b2562d2b77b93af794413476",
"payload_hash": "5d5f0dc425898c68f80c500010c2b437",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net"
},
"target_context": {
"dst_port": 8882,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \r]\ufffd]\ufffdm^z\u001fT]\"\u0002\u000e\ufffd\u001e\ufffd\ufffdE4\ufffd\ufffd?\ufffdp\ufffd\u00036C\ufffdb\u0000\ufffd\ufffd\ufffd\u0003Z\n\ufffd\bD\ufffd\ufffd\bia\u001c|\u0005\ufffd\u001d\u04577\ufffdUe\ufffd>\ufffd\ufffd\ufffd\ufffdJ\ufffd\u000fTP\rfzu\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd-r\ufffd{l\ufffd\ufffd\ufffd\ufffd]@\ufffd\ufffd*W\ufffd\ufffd\u0698\ufffdo+\\7",
"payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1644eb2c53ef4be97772d41d03a1791c225ff6c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "5ff4aa95b2562d2b77b93af794413476",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 8882,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\ufffd2\ufffdn*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\ufffd^;$s\u0291\ufffdMN\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:8882 \u00b7 (sonde \/ probe)",
"target_port_label": "8882 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8882,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "5ff4aa95b2562d2b77b93af794413476",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 8882,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:8882 \u00b7 (sonde \/ probe)",
"evidence_snippet": "n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\ufffd2\ufffdn*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\ufffd^;$s\u0291\ufffdMN\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8882 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8882"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:8882",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8882
|
—
|
Sonde Kafka
kafka probe · port 8882 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8882
Chemin / cible
—
Payload
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 520,
"payload_entropy": 3.999375592941219,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 8882,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5158132f4e26a64058e1280324f3d1c585c96fc4",
"event_fingerprint": "9804da3c002967109d9f6881ad267bd8ea8f65c3",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3406a76f136d489bc5c37b989c06ec84",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8882,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ceacb651ddbf7236112b6d4dea965f0bf28377b",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8882
},
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 8882 \u00b7 (sonde \/ probe)",
"target_port_label": "8882",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 8882,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8882
},
"attack_vector": "kafka probe \u00b7 port 8882 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "8882",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8882"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8381
|
—
|
Sonde Kafka
kafka probe · port 8381 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8381
Chemin / cible
—
Payload
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
55%
Corrélation +8
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 516,
"payload_entropy": 3.9791255536617784,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 8381,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8d6ee96ca72c5057e3f5267d7041310476c2b0ed",
"event_fingerprint": "99e2869b28ab9d130a72ff0ddf89b6fad8d0e54e",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8381,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1ca1f76db10eef7246e619ba09e66c04cc98e86",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8381
},
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 8381 \u00b7 (sonde \/ probe)",
"target_port_label": "8381",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 8381,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8381
},
"attack_vector": "kafka probe \u00b7 port 8381 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "8381",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8381"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:8381",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8381 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:8381 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 83cafa166c82a2b1
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8381
Chemin / cible
—
Service
TLS
Payload
: 6h���r��t�,�s�� i�����²�ڂe� 4�&��Q<������L.n�v��e�)(|��H ���+�/�,�0̨̩�� � � / 5 �:: + �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
: 6h���r��t�,�s�� i�����²�ڂe� 4�&��Q<������L.n�v��e�)(|��H ���+�/�,�0̨̩�� � � / 5 �:: + �
Requête brute (extrait)
: 6h���r��t�,�s�� i�����²�ڂe� 4�&��Q<������L.n�v��e�)(|��H ���+�/�,�0̨̩�� � � / 5 �:: + ��� - �5UN���n�p�7M�����V+ZRx)c+} ���i4k��f�V��.Wϵf���&❢��ƋTPzL�EI�㘄�<��-�;�i���� �1��ѵe���".�`��w�
Meta JSON brut
{
"tls_ja3_hash": "83cafa166c82a2b12a47f042c7c94a06",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 575,
"payload_entropy": 7.023556790168638,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8381,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ffcc1c6f03370d696ac4fe1dfcd4c543447ef178",
"event_fingerprint": "85d219564db7fa9f472ff377dcd22eba3bbfee05",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "83cafa166c82a2b12a47f042c7c94a06",
"payload_hash": "c7c2f8d3943671718b18528290f80dae",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8381,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001-\u0000 \ufffd5\u0011UN\u0004\ufffd\ufffd\ufffdn\ufffdp\ufffd7M\ufffd\ufffd\ufffd\ufffd\ufffdV+ZRx\u0001\u0007\u0003)c+}\u0000\ufffd\ufffd\ufffdi4k\ufffd\ufffdf\ufffdV\ufffd\ufffd.W\u03f5\u0013f\ufffd\ufffd\ufffd&\u2762\ufffd\ufffd\u018bTPzL\ufffdEI\ufffd\u3604\u0018\ufffd<\ufffd\ufffd-\ufffd;\ufffdi\ufffd\ufffd\ufffd\ufffd\u001c\ufffd1\ufffd\ufffd\u0475e\ufffd\ufffd\ufffd\".\ufffd`\ufffd\ufffdw\ufffd\r\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001-\u0000 \ufffd5\u0011UN\u0004\ufffd\ufffd\ufffdn\ufffdp\ufffd7M\ufffd\ufffd\ufffd\ufffd\ufffdV+ZRx\u0001\u0007\u0003)c+}\u0000\ufffd\ufffd\ufffdi4k\ufffd\ufffdf\ufffdV\ufffd\ufffd.W\u03f5\u0013f\ufffd\ufffd\ufffd&\u2762\ufffd\ufffd\u018bTPzL\ufffdEI\ufffd\u3604\u0018\ufffd<\ufffd\ufffd-\ufffd;\ufffdi\ufffd\ufffd\ufffd\ufffd\u001c\ufffd1\ufffd\ufffd\u0475e\ufffd\ufffd\ufffd\".\ufffd`\ufffd\ufffdw\ufffd\r\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd2894a9828b22426de1fd0a22f658593aba8648",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd",
"tls_ja3": "83cafa166c82a2b12a47f042c7c94a06",
"port": 8381,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": ":6h\ufffd\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\ufffd\ufffdH \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::+\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:8381 \u00b7 (sonde \/ probe)",
"target_port_label": "8381 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8381,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd",
"tls_ja3": "83cafa166c82a2b12a47f042c7c94a06",
"port": 8381,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:8381 \u00b7 (sonde \/ probe)",
"evidence_snippet": ":6h\ufffd\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(|\ufffd\ufffdH \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::+\ufffd",
"target_port_label": "8381 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8381"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8852 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:8852 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9c0ebf3a1c43cd47 SNI ip-62-3-50-33.v4.isp.servpersosystems.net
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
ip-62-3-50-33.v4.isp.servpersosystems.net
Capteur
paris-1
|
Méthode
—
Port
8852
Chemin / cible
—
Service
TLS
SNI TLS
ip-62-3-50-33.v4.isp.servpersosystems.net
Payload
Ӟ�&� �^�/ i�.�4X��x{jB%>6�d�< *Ȑd�>a& ߞ�7��^Ҁ� t��+�}F�� ���+�/�,�0̨̩�� � � / 5 �zz �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
Ӟ�&�
�^�/ i�.�4X��x{jB%>6�d�< *Ȑd�>a& ߞ�7��^Ҁ� t��+�}F�� ���+�/�,�0̨̩�� � � / 5 �zz �
Requête brute (extrait)
Ӟ�&� �^�/ i�.�4X��x{jB%>6�d�< *Ȑd�>a& ߞ�7��^Ҁ� t��+�}F�� ���+�/�,�0̨̩�� � � / 5 �zz � - Di h2 . , )ip-62-3-50-33.v4.isp.servpersosystems.net h2http/1.1 +
Meta JSON brut
{
"tls_ja3_hash": "9c0ebf3a1c43cd475c2d383c5063cd3a",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 529,
"payload_entropy": 6.834079908596782,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8852,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3619c69734eeea88cd5bfd2fe046e9f368689fd5",
"event_fingerprint": "737cabfe0db76937f3a3ddf1dc4b8d5ad94c7ac2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "9c0ebf3a1c43cd475c2d383c5063cd3a",
"payload_hash": "f792c9744a6c6acaded71ca3925c1cb9",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net"
},
"target_context": {
"dst_port": 8852,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< *\u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< *\u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000-\u0000\u0002\u0001\u0001Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\u0007\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< *\u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08d91adf50302b0f571e6ff0541aac7eac7d69b2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< *\u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000",
"tls_ja3": "9c0ebf3a1c43cd475c2d383c5063cd3a",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 8852,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\u04de\ufffd&\ufffd\r\ufffd^\ufffd\/i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>6\ufffdd\ufffd< *\u0210d\ufffd>a&\u07de\ufffd7\ufffd\ufffd^\u0480\ufffdt\ufffd\ufffd+\ufffd}F\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzz\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)",
"target_port_label": "8852 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8852,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< *\u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000",
"tls_ja3": "9c0ebf3a1c43cd475c2d383c5063cd3a",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 8852,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\u04de\ufffd&\ufffd\r\ufffd^\ufffd\/i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>6\ufffdd\ufffd< *\u0210d\ufffd>a&\u07de\ufffd7\ufffd\ufffd^\u0480\ufffdt\ufffd\ufffd+\ufffd}F\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzz\ufffd",
"target_port_label": "8852 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8852"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8852 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8852 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 20b279993ae2e137 SNI www.blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
Cible HTTP
—
TLS SNI
www.blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
8852
Chemin / cible
—
Service
TLS
SNI TLS
www.blacklistip.com
Payload
� ���R+��@�O&�p {�'���d���/E$ tE�TF�w���¯�?�� ؓ�jG5�WH��H �+�/�,�0̨̩� �� � { www.blackli
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���R+��@�O&�p {�'���d���/E$ tE�TF�w���¯�?��
ؓ�jG5�WH��H �+�/�,�0̨̩� ��
� { www.blackli
Requête brute (extrait)
� ���R+��@�O&�p {�'���d���/E$ tE�TF�w���¯�?�� ؓ�jG5�WH��H �+�/�,�0̨̩� �� � { www.blacklistip.com � � 2 + 3��
Meta JSON brut
{
"tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "www.blacklistip.com",
"bytes_in": 1511,
"payload_entropy": 7.72882537851668,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8852,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "9f178c0ef11b1b3ef0df35a3e9ce11996a2b1382",
"event_fingerprint": "225bb6b0595e6661bb027590242d5903c0f79a0b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "20b279993ae2e137e62b9647c6d768fb",
"payload_hash": "a258efec4bb3d974757976048bc90e7b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "www.blacklistip.com"
},
"target_context": {
"dst_port": 8852,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3bfc7d7ca8b63213697e35cdc4a1bd7d310dec94",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "www.blacklistip.com",
"port": 8852,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdR+\ufffd\ufffd@\ufffdO&\ufffdp{\ufffd'\ufffd\ufffd\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli",
"attack_vector": "postgres probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)",
"target_port_label": "8852 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8852,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "www.blacklistip.com",
"port": 8852,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdR+\ufffd\ufffd@\ufffdO&\ufffdp{\ufffd'\ufffd\ufffd\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli",
"target_port_label": "8852 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8852"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3"
]
}
|
|
|
TCP |
8251 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:8251 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 7012bcfb2b0920ab SNI www.blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
www.blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
8251
Chemin / cible
—
Service
TLS
SNI TLS
www.blacklistip.com
Payload
6 2����߮N����(wIn2%S3���]i�A �FGc9!�%��膧�ܡ%�Y,a� i�� ���+�/�,�0̨̩�� � � / 5 �JJ Di h2
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
6 2����߮N����(wIn2%S3���]i�A �FGc9!�%��膧�ܡ%�Y,a� i�� ���+�/�,�0̨̩�� � � / 5 �JJ Di h2
Requête brute (extrait)
6 2����߮N����(wIn2%S3���]i�A �FGc9!�%��膧�ܡ%�Y,a� i�� ���+�/�,�0̨̩�� � � / 5 �JJ Di h2 � www.blacklistip.com + � � � m[�'��r�m�EY1^�䷂������ T�a Н�g�D$��?u�}�s�G���H��*�� �}�
Meta JSON brut
{
"tls_ja3_hash": "7012bcfb2b0920ab2103357b24822ce5",
"tls_sni": "www.blacklistip.com",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 571,
"payload_entropy": 6.924622605338042,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8251,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c506047fd69c82c68a20037ea0ecee7ba28958d3",
"event_fingerprint": "8c18a342e9570941ee3e5ea6c3255c43872df895",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "7012bcfb2b0920ab2103357b24822ce5",
"payload_hash": "bd317160b9603f4d1c7f54a133dbd799",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "www.blacklistip.com"
},
"target_context": {
"dst_port": 8251,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000+\u0000\u0007\u0006\n\n\u0003\u0004\u0003\u0003\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 m[\ufffd'\ufffd\u0004\ufffdr\ufffdm\ufffdEY1^\ufffd\u4dc2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001dT\ufffda\u0000\u041d\ufffdg\ufffd\u0003D$\ufffd\ufffd?u\ufffd}\ufffds\ufffdG\ufffd\ufffd\ufffdH\ufffd\ufffd*\ufffd\ufffd\u001f\u001c\ufffd}\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "639869f7adea9c63ebb24d753dea76ad88a7c326",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"tls_ja3": "7012bcfb2b0920ab2103357b24822ce5",
"tls_sni": "www.blacklistip.com",
"port": 8251,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "62\ufffd\ufffd\ufffd\ufffd\u07eeN\ufffd\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffdA \ufffdFGc9!\ufffd%\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY,a\ufffdi\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdJJDih2",
"attack_vector": "tls probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)",
"target_port_label": "8251 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8251,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"tls_ja3": "7012bcfb2b0920ab2103357b24822ce5",
"tls_sni": "www.blacklistip.com",
"port": 8251,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)",
"evidence_snippet": "62\ufffd\ufffd\ufffd\ufffd\u07eeN\ufffd\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffdA \ufffdFGc9!\ufffd%\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY,a\ufffdi\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdJJDih2",
"target_port_label": "8251 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8251"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
8251 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8251 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 fb60ce4e775fabbb
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8251
Chemin / cible
—
Service
TLS
Payload
� ���Y#J�@�a�N��m^N�yCP��� �ڴd7���te ��ʔ,ȭ x����ń�ɐ�P jj�+�/�,�0̨̩�� � � / 5 m��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���Y#J�@�a�N��m^N�yCP��� �ڴd7���te ��ʔ,ȭ x����ń�ɐ�P jj�+�/�,�0̨̩�� � � / 5 m��
Requête brute (extrait)
� ���Y#J�@�a�N��m^N�yCP��� �ڴd7���te ��ʔ,ȭ x����ń�ɐ�P jj�+�/�,�0̨̩�� � � / 5 m�� � � � ��_�|Z\p��Hf5��́,�TGmh��+�h �a]r+C�������9�N�ӯ�稣[mf���p9���d8�W�3�ƺS�%�UR��������=V0�������9!{�+ �
Meta JSON brut
{
"tls_ja3_hash": "fb60ce4e775fabbb3ed7f2c475b3abfb",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 479,
"payload_entropy": 6.796220745942962,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8251,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c1e4495d1d7d206cfafc7319cbc753a20669b155",
"event_fingerprint": "e51f04358c6572cde5c81292b69fd435fd1f6474",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "fb60ce4e775fabbb3ed7f2c475b3abfb",
"payload_hash": "8ee52774910d4f9aa92da333a00d800c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8251,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000\u001d\u0000\u0017\u0000\u0018\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffd\u0006_\ufffd|Z\\p\ufffd\u0011\ufffdHf\u001b5\ufffd\ufffd\u0301,\ufffdTGmh\ufffd\ufffd+\ufffdh\u0000\ufffda]r+C\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd9\ufffdN\ufffd\u04ef\ufffd\u7a23[mf\ufffd\ufffd\ufffdp9\ufffd\ufffd\ufffdd8\ufffdW\ufffd3\ufffd\u01baS\ufffd%\u001b\ufffdUR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=V0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9!{\ufffd+\u001e\f\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16483ad232ff418f9cb95221e1d802c034a3950a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000",
"tls_ja3": "fb60ce4e775fabbb3ed7f2c475b3abfb",
"port": 8251,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY#J\ufffd@\uf1e6\ufffda\ufffdN\ufffd\ufffdm^N\ufffdyCP\ufffd\ufffd\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\ufffd\ufffd\u0294,\u022dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)",
"target_port_label": "8251 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8251,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000",
"tls_ja3": "fb60ce4e775fabbb3ed7f2c475b3abfb",
"port": 8251,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY#J\ufffd@\uf1e6\ufffda\ufffdN\ufffd\ufffdm^N\ufffdyCP\ufffd\ufffd\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\ufffd\ufffd\u0294,\u022dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m\ufffd\ufffd",
"target_port_label": "8251 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8251"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6496 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:6496 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
Cible HTTP
—
TLS SNI
ip-62-3-50-33.v4.isp.servpersosystems.net
Capteur
paris-1
|
Méthode
—
Port
6496
Chemin / cible
—
Service
TLS
SNI TLS
ip-62-3-50-33.v4.isp.servpersosystems.net
Payload
� �K��V� ��Z9B� ��{k�S ��t �� k 1Y eNzQ?�cB����V���v�a^�� �+�/�,�0̨̩� �� � � . , )ip-62-3-50-
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �K��V� ��Z9B�
��{k�S ��t �� k
1Y eNzQ?�cB����V���v�a^�� �+�/�,�0̨̩� ��
� � . , )ip-62-3-50-
Requête brute (extrait)
� �K��V� ��Z9B� ��{k�S ��t �� k 1Y eNzQ?�cB����V���v�a^�� �+�/�,�0̨̩� �� � � . , )ip-62-3-50-33.v4.isp.servpersosystems.net � � 2
Meta JSON brut
{
"tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"bytes_in": 1533,
"payload_entropy": 7.722105118695942,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 6496,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5935821f80d8b59d41594f33de4c84b7dd261f0f",
"event_fingerprint": "a86433e9c81b8f6cb1b91e5a8162f5d5670f5280",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "20b279993ae2e137e62b9647c6d768fb",
"payload_hash": "097cd6a634628a5e931c3a9e68508494",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net"
},
"target_context": {
"dst_port": 6496,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "887948102a8a084c29bdd40e64aeaaba6ab86711",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 6496,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdK\ufffd\ufffdV\ufffd\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffdS \ufffd\ufffdt\ufffd\ufffd k\r1YeNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-",
"attack_vector": "postgres probe \u00b7 via TLS:6496 \u00b7 (sonde \/ probe)",
"target_port_label": "6496 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6496,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
"port": 6496,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:6496 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdK\ufffd\ufffdV\ufffd\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffdS \ufffd\ufffdt\ufffd\ufffd k\r1YeNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-",
"target_port_label": "6496 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6496"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3"
]
}
|
|
|
TCP |
8385
|
—
|
Sonde Kafka
kafka probe · port 8385 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8385
Chemin / cible
—
Payload
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 501,
"payload_entropy": 3.7940870380940184,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 8385,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3ca6cca12cc5bfd0b422f4c0b33368f0691f9b02",
"event_fingerprint": "c81b0061cfcd8a5fbff9434e5c008c388e5804a3",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29b5329f45e73a6677bca0caf0ca278c",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8385,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e8adbc09fdefc8bb01056f907edec5705a560e",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8385
},
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 8385 \u00b7 (sonde \/ probe)",
"target_port_label": "8385",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 8385,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8385
},
"attack_vector": "kafka probe \u00b7 port 8385 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "8385",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8385"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9302
|
—
|
Sonde Kafka
kafka probe · port 9302 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9302
Chemin / cible
—
Payload
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
�߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 520,
"payload_entropy": 3.999375592941219,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 9302,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a890cb7787e591ebca8599b4905df8ea83ab64c0",
"event_fingerprint": "7a2c4fd2ec1d3e40c57911329502a5a09262b62c",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3406a76f136d489bc5c37b989c06ec84",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 9302,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5994e66414cdafbd87d18521ca4a5bfb62224e9d",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 9302
},
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 9302 \u00b7 (sonde \/ probe)",
"target_port_label": "9302",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 9302,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 9302
},
"attack_vector": "kafka probe \u00b7 port 9302 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "9302",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9302"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8810
|
—
|
Sonde Kafka
kafka probe · port 8810 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8810
Chemin / cible
—
Payload
߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 542,
"payload_entropy": 4.161650730260368,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 8810,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d2329771023701dad97857c5766a92c671d0266d",
"event_fingerprint": "36122160427162dddd02cf2b97fa2ed424fa9baa",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4509eec7340acca41e94bc6bae32c197",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8810,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2477b12123daf001f84f4d4d886520fdb61f3322",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8810
},
"evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 8810 \u00b7 (sonde \/ probe)",
"target_port_label": "8810",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 8810,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8810
},
"attack_vector": "kafka probe \u00b7 port 8810 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "8810",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8810"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8887 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8887 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 20b279993ae2e137 SNI blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
Cible HTTP
—
TLS SNI
blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
8887
Chemin / cible
—
Service
TLS
SNI TLS
blacklistip.com
Payload
� �`�s�FY��=Эy�z���w�� ����%�<#�� T�Y3| �h����q�D�2#d�� 3 � �+�/�,�0̨̩� �� � w blacklistip
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �`�s�FY��=Эy�z���w�� ����%�<#�� T�Y3|
�h����q�D�2#d�� 3 � �+�/�,�0̨̩� ��
� w blacklistip
Requête brute (extrait)
� �`�s�FY��=Эy�z���w�� ����%�<#�� T�Y3| �h����q�D�2#d�� 3 � �+�/�,�0̨̩� �� � w blacklistip.com � � 2 + 3�����
Meta JSON brut
{
"tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"bytes_in": 1507,
"payload_entropy": 7.700250524250067,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 8887,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6b6bfa97410ec4e5c941cf84df7332d20a28a329",
"event_fingerprint": "c708bdf60ed1e61ce833993dd66744ef531c8c61",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "20b279993ae2e137e62b9647c6d768fb",
"payload_hash": "1f126d08e7d72d0c249bb2bb51b1c998",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "blacklistip.com"
},
"target_context": {
"dst_port": 8887,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c5420a0f024c19a07d9ddc196223be6d5f309e7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"port": 8887,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffdw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffdY3|\n\ufffdh\ufffd\ufffd\ufffd\ufffdq\ufffdD\ufffd2#d\ufffd\ufffd3\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
"attack_vector": "postgres probe \u00b7 via TLS:8887 \u00b7 (sonde \/ probe)",
"target_port_label": "8887 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8887,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"port": 8887,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8887 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffdw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffdY3|\n\ufffdh\ufffd\ufffd\ufffd\ufffdq\ufffdD\ufffd2#d\ufffd\ufffd3\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
"target_port_label": "8887 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8887"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3"
]
}
|
|
|
TCP |
7776 · TLS
|
tls
|
Sonde Kafka
kafka probe · via TLS:7776 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 90c839a85a368ff2 SNI blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
7776
Chemin / cible
—
Service
TLS
SNI TLS
blacklistip.com
Payload
2 .�$�ݎ�S�W�S���<�m3SLq��L T� ?N�k�o��1�LF�L �R���B[��� �+�/�,�0̨̩�� � � / 5 Ū� + ��
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
55%
Corrélation +8
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
Sybase TDS login
STUN binding
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
2 .�$�ݎ�S�W�S���<�m3SLq��L T� ?N�k�o��1�LF�L �R���B[���
�+�/�,�0̨̩�� � � / 5 Ū� + ��
Requête brute (extrait)
2 .�$�ݎ�S�W�S���<�m3SLq��L T� ?N�k�o��1�LF�L �R���B[��� �+�/�,�0̨̩�� � � / 5 Ū� + �� � jj # � � > ����u[���(�XO�P,����� �����- �xg�@ATd�@*T���V
Meta JSON brut
{
"tls_ja3_hash": "90c839a85a368ff2a0307977d5346dfe",
"tls_sni": "blacklistip.com",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 567,
"payload_entropy": 6.968697949708957,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 7776,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "795f520791427132d72e655444dffc0db53a3488",
"event_fingerprint": "2e8b3cf347290afdb07bc85bd49c1982e01cd57f",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0607",
"pat-0771",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"Sybase TDS login",
"STUN binding",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0607",
"pat-0771",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 32,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "90c839a85a368ff2a0307977d5346dfe",
"payload_hash": "cfee08210f366b4de8f54bffd722b8af",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13",
"tls_sni": "blacklistip.com"
},
"target_context": {
"dst_port": 7776,
"service": "tls",
"service_name": "tls",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\n\u0000\bjj\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000#\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001>\u0000 \ufffd\u0015\ufffd\ufffd\ufffdu[\ufffd\ufffd\ufffd(\ufffdX\u0005O\ufffdP,\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\n\ufffd\u0015\ufffd\ufffd\ufffd\ufffd-\u0000\ufffdxg\ufffd@ATd\ufffd@*T\ufffd\ufffd\ufffdV",
"payload_snippet": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e354ef1e826500dcc91e7b9c7b521fda870b26f7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003",
"tls_ja3": "90c839a85a368ff2a0307977d5346dfe",
"tls_sni": "blacklistip.com",
"port": 7776,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "2.\ufffd$\ufffd\u074e\ufffdS\ufffdW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffdLT\ufffd ?N\ufffdk\ufffdo\ufffd\ufffd1\ufffdLF\ufffdL\ufffdR\ufffd\ufffd\ufffdB[\ufffd\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u016a\ufffd+\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via TLS:7776 \u00b7 (sonde \/ probe)",
"target_port_label": "7776 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 32,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 7776,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003",
"tls_ja3": "90c839a85a368ff2a0307977d5346dfe",
"tls_sni": "blacklistip.com",
"port": 7776,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "kafka probe \u00b7 via TLS:7776 \u00b7 (sonde \/ probe)",
"evidence_snippet": "2.\ufffd$\ufffd\u074e\ufffdS\ufffdW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffdLT\ufffd ?N\ufffdk\ufffdo\ufffd\ufffd1\ufffdLF\ufffdL\ufffdR\ufffd\ufffd\ufffdB[\ufffd\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u016a\ufffd+\ufffd\ufffd",
"target_port_label": "7776 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "7776"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:12499",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
7776 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:7776 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 20b279993ae2e137 SNI blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
Cible HTTP
—
TLS SNI
blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
7776
Chemin / cible
—
Service
TLS
SNI TLS
blacklistip.com
Payload
� �y�� �cZ�� �p8��:Q�{Y�e���A���� ���"�(a�֓�<`���G�a�,�]�wn=� �+�/�,�0̨̩� �� � w blacklistip
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �y�� �cZ�� �p8��:Q�{Y�e���A���� ���"�(a�֓�<`���G�a�,�]�wn=�
�+�/�,�0̨̩� ��
� w blacklistip
Requête brute (extrait)
� �y�� �cZ�� �p8��:Q�{Y�e���A���� ���"�(a�֓�<`���G�a�,�]�wn=� �+�/�,�0̨̩� �� � w blacklistip.com � � 2 + 3����?
Meta JSON brut
{
"tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"bytes_in": 1507,
"payload_entropy": 7.7017728480371765,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "tls",
"app_proto": "tls",
"asn": 62610,
"country": "US",
"dst_port": 7776,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "84ed768948c5acf836e7c51b6cd3af240d828251",
"event_fingerprint": "49c88faf46f85d11e53c766b653d628550784a41",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "20b279993ae2e137e62b9647c6d768fb",
"payload_hash": "316b7a98b59f55ca5a59bd040e0f6496",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "blacklistip.com"
},
"target_context": {
"dst_port": 7776,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003y\ufffd\ufffd\u0000\ufffdcZ\ufffd\ufffd\u0016\u000b\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\u0014\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\u0001\ufffd\"\u001b\ufffd\u0017(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003y\ufffd\ufffd\u0000\ufffdcZ\ufffd\ufffd\u0016\u000b\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\u0014\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\u0001\ufffd\"\u001b\ufffd\u0017(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd?",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003y\ufffd\ufffd\u0000\ufffdcZ\ufffd\ufffd\u0016\u000b\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\u0014\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\u0001\ufffd\"\u001b\ufffd\u0017(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e808f7d63fe1778bd3e728596b38a2ac04f8ffd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003y\ufffd\ufffd\u0000\ufffdcZ\ufffd\ufffd\u0016\u000b\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\u0014\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\u0001\ufffd\"\u001b\ufffd\u0017(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"port": 7776,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdy\ufffd\ufffd\ufffdcZ\ufffd\ufffd\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\"\ufffd(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
"attack_vector": "postgres probe \u00b7 via TLS:7776 \u00b7 (sonde \/ probe)",
"target_port_label": "7776 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 7776,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003y\ufffd\ufffd\u0000\ufffdcZ\ufffd\ufffd\u0016\u000b\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\u0014\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\u0001\ufffd\"\u001b\ufffd\u0017(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
"tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
"tls_sni": "blacklistip.com",
"port": 7776,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:7776 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdy\ufffd\ufffd\ufffdcZ\ufffd\ufffd\ufffdp8\ufffd\ufffd:Q\ufffd{Y\ufffde\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\"\ufffd(a\ufffd\u0593\ufffd<`\ufffd\ufffd\ufffdG\ufffda\ufffd,\ufffd]\ufffdwn=\ufffd\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
"target_port_label": "7776 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "7776"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:12499",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3"
]
}
|
|
|
TCP |
12499
|
—
|
Sonde Kafka
kafka probe · port 12499 · (sonde / probe)
|
Faible
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12499
Chemin / cible
—
Payload
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ
|Ufj�](S�)f�<
R%��'_ "̨̩�+�/�,�0����S � � / 5 � �
Requête brute (extrait)
� �߳��������N�+=L���ڠ�ӭ�� ɓ% 5�OET ѝ |Ufj�](S�)f�< R%��'_ "̨̩�+�/�,�0����S � � / 5 � � # h2http/1.1 3 & $ sH?�ߑ��`��%�ϋ5��߅�wM�� - +
Meta JSON brut
{
"bytes_in": 501,
"payload_entropy": 3.7940870380940184,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": null,
"app_proto": null,
"asn": 62610,
"country": "US",
"dst_port": 12499,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "053167de9ba4a959a77c53d5472083b31b5a227b",
"event_fingerprint": "2e71fc534d1198d3b97b2569327045bdabab5636",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 62610,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29b5329f45e73a6677bca0caf0ca278c",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 12499,
"risk_score": 32
},
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
"payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a524e29816648d89d485cb8b9468f6948c84c55",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 12499
},
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 port 12499 \u00b7 (sonde \/ probe)",
"target_port_label": "12499",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 12499,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 12499
},
"attack_vector": "kafka probe \u00b7 port 12499 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
"target_port_label": "12499",
"emulator_service": null,
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12499"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
|